Authorization

It is done by API server using Roles