add permission removal endpoint