Correct permissions for scheduled-job REST APIs