updated api and data files to handle permissions for allowed paths in api