This isn't critical, but I would do this sort of data validation first. In fact, I would think we should get rid of the duplicate data altogether (namely, eliminate `permissionId` from the method signature). In fact, this is a long standing issue that exists in a number of our REST endpoints.