Permissions checks in message API are baked into external function wrappers. It sounds like this is existing with messaging but "api" has become a not a usable api by anything outside of messaging. Since this is existing no change is required in this issue.