add api permissions