updated permissions; basic api testing in merged version