create category api with check user permission on each action which need it