It seems the updatePermission endpoint is called for the purpose of activation code and email verification, is that correct? And, that is when the permissions granted are actually assigned to the user, by virtue of including their user id on that permission.