More permissions tightening in the API