api end point to retrieve list of connections

there should be two tests. One that verifies it's forbidden, and one successful. Try not to make multiple assertions in one tests to help aid in making it clear what should work and so that if you're debugging a failing test you can easily run the one in isolation.