Authorization for API lists controller