Public API

no auth needed, just hit the endpoints