Hi there.\n\nI've created an API in superset in the config file.\nIt shows up in swagger UI and I can call it successfully.\nMy next step is to make sure that it can only be accessed if you have the correct permissions.\n\nSo first I tried adding the @protect() decorator.\nThis makes it so I get 401 when accessing the API.\n```{"message":"Access is Denied","severity":"danger"}```\nSo far so good. Now I log in with an admin user using the /api/v1//security/login API and I get a token.\nThen I set the Authorization header on my REST call to my new API and I still get 401.\nSo I thought mayby I need to add the permission to my role. So I add this decorator @permission_name("AAAAAA")\nAnd I go to find that permission in the roles edit section, but it cannot be found.\nI have tried several different ways to see if I can gain access to the API:\n1. Tried to change the permission name to some existing permission\n2. Instead of @protect() I tried @has_access_api\n3. I have tried setting the class_permission_name\nand a few other things and I have spent many hours on this so far searching the net and reading the code and documentation.\n\nDoes anyone know what the correct way is to protect the API endpoint in the same way as the Dashboards and Charts APIs are protected?\nFor reference here is the basic code I am using without permissions:\n```class AuthorizationAPI(BaseApi):\n    csrf_exempt= True\n    @expose('/role/&lt;role&gt;', methods=["POST"])\n    @safe\n    def role(self, role):\n       #My code here\n\nfrom <http://superset.app|superset.app> import SupersetAppInitializer\n\nclass MySupsersetAppInitializer(SupersetAppInitializer):\n    def init_views(self) -&gt; None:\n        appbuilder.add_api(AuthorizationAPI)\n        super().init_views()\n\n\nAPP_INITIALIZER = MySupsersetAppInitializer```