make it into a collection
add default permissions
fix param name to match api