permit access for parts of the api