What is the requirement for permission here as they are already provided during login API?