allow header for api