Update permissions for API routes