getting user rights back from api