update api with new dsid param perm check