Adding user role access criterias to APIs