yeah available directly under a server_url_secret key in the json body its passing the secret.. not ideal for security