Tested & implemented user permissions API endpoint