[BIS2027] permit `subject_ids` on api endpoint