which is a rest call w/ credentials only