TODO make data input sanitization validate input add admin policies better response for api (use same data key)