extending disallowed flags for rest api + using QueryFlags to represent the disallowed flags.