API permission checking done