Schedule model, API endpoints with permissions