BS-11147, fix permission api test to have a real json body