update rest api permission class