adding multiple roles for api declaration; tested