Test new API permissions route