xform share api endpoint

we're checking a map so better to use `if value not in ROLES:`