use class based ApiRoot view and added permission