Rearrange api permissions