REST API role permissions