(#165) Fix permissions for APIs that don't expose Create/Update/Delete