update permissions for apis that were missed
Merge pull request #2650 from dimagi/api-permissions

update permissions for apis that were missed