set api permissions, check type not isinstance when assigning permissions for role