only api requests allowed