added PermissionList API for getting and managing user object permissions