formList endpoint with permissions with backward compatibility to existing endpoint

closes #262