update permissions on api docs