diff --git a/README.md b/README.md
index 6b968d3..c38097a 100644
--- a/README.md
+++ b/README.md
@@ -41,14 +41,14 @@ The API will be a combination API and basic SSR.
 
 - /api - SSR Page: shows login form
   - /api/[userId] - SSR Page: provides import plan button to upload an existing xivplan url to the db, shows all user's plans (have section for deleted plans), each plan should have the following buttons: [Open], [Share], [Rename*] [Delete*] Buttons with an \* will prompt for PIN to confirm.
-    - /api/[userId]/list - API Page: GET returns non-deleted plans, specifically the name, id, and folder of each plan as a JSON array of objects
-    - /api/[userId]/export - API Page: GET returns zip of .xivplan files
-    - /api/[userId]/create - API Page: POST to save new plan to DB, requires name, pin, and data (optionally folder), api will generate a nanoid for the PK
-    - /api/[userId]/update/[planId] - API Page: PUT to overwrite plan while keeping same name and id, requires PIN and data
-    - /api/[userId]/delete/[planId] - API Page: DELETE to mark plan as deleted, requires PIN
-    - /api/[userId]/undelete/[planId] - API Page: PUT to unmark plan as deleted, requires PIN
-    - /api/[userId]/read/[planId] - API Page: GET returns name and data as JSON object
-  - /api/auth - API Page: POST to check if you are who you say you are, requires username and pin, returns userId and boolean of if email was set
-  - /api/enroll - API Page: POST to create new user, requires username and pin (optionally email), returns userId
-  - /api/unenroll - API Page: DELETE to get rid of user and all of their plans, requires username and pin (and deletion-confirmation-code if email present)
+    - /api/[userId]/list - API Page: **GET** returns non-deleted plans, specifically the name, id, and folder of each plan as a JSON array of objects
+    - /api/[userId]/export - API Page: **GET** returns zip of .xivplan files
+    - /api/[userId]/create - API Page: **POST** to save new plan to DB, requires name, **PIN**, and data (optionally folder), api will generate a nanoid for the PK
+    - /api/[userId]/update/[planId] - API Page: **PUT** to overwrite plan while keeping same name and id, requires **PIN** and data
+    - /api/[userId]/delete/[planId] - API Page: **DELETE** to mark plan as deleted, requires **PIN**
+    - /api/[userId]/undelete/[planId] - API Page: **PUT** to unmark plan as deleted, requires **PIN**
+    - /api/[userId]/read/[planId] - API Page: **GET** returns name and data as JSON object
+  - /api/auth - API Page: **POST** to check if you are who you say you are, requires username and **PIN**, returns userId and boolean of if email was set
+  - /api/enroll - API Page: **POST** to create new user, requires username and **PIN** (optionally email), returns userId
+  - /api/unenroll - API Page: **DELETE** to get rid of user and all of their plans, requires username and **PIN** (and deletion-confirmation-code if email present)
     - If email present on user and delete-confirmation-code not present, send delete-confirmation-code to user and have them redo form