added some changes to api permissions