feat(api): api permissions added