api secured permissions