Public endpoint - no authentication required