Fix/experimental api missing authorizations

https://www.openproject.org/work_packages/15710
Is there a good way to deduplicate all these valid_params? E.g. filling variable parts with results form other `let`s that can be overridden in child blocks?