unprotected APIs