Spin out API fields to add granular permissions