API endpoint - not for public access