Basic permission listing API, cleaned tests