fixed permissions for legacy api