refractor to use no params + get endpoint for testing permission