finished api work on relationships permissions