CDB-3103 stabilization + disallow sending permission_id on vis creation endpoint