non-secure HTTP API link