Authrozation extension - permission tied to API