More concise required permissions for API calls.
Added apiKey header insert for global ajaxSetup