These APIs now pass through AuthCheckRole but the seed data bound none of them to a menu, so a role saved through the menu tree could not be granted them. Bind them to the matching permission menus and grant existing roles that already hold those menus.