implemented POST for creating object-level permissions via REST API PermissionList