API endpoint permissions