improvements on api methods + permission mixin + simple api for resources