API endpoints being root only is the default if nothing else is specified. seems like those two "index" endpoints are lacking the permissions attribute, which should be fixed. but like @gyptazy said, the information is already available via other endpoints as well!