added more permission features to the api
set db