fix privileges api