[api] move the complete permission check in a function on its own

Using functions of the request and the action model