rearrange api code for orders by permissions