enhance API and permissions