review and fix permission for api + write a permissions documentation
review and fix permission for api