test(api): cover effective-permission and authorization check endpoints