add security permissions for new bdm rest APIs