Feature/api permissions