add permission check in API event/update