formList endpoint with permissions with backward compatibility to existing endpoint