more rest with permissions this time