API + app permissions update