as per best practices
- use existing access mechanisms for validation - adds swagger/schema and validation of incoming payload