api updates, added serializers and started permissions