updated: Tags API permissions