requiring specific roles in api