add api for permissions