Added user permission(scopes) validation methods to api controller. Now API request can be validated based on users permissions.