Public endpoint — no token required