get /role API should have a list of permissions