send userId and the subscriptionId for permission checking functions
version bumped