Added permissions checking to api