add permissions urls