Dashboard endpoint - not for direct access