change permission class on api