changed api root and updated permissions