diff --git a/internal/configuration/database/Database_test.go b/internal/configuration/database/Database_test.go
index 2c7bca2b..caa7e04f 100644
--- a/internal/configuration/database/Database_test.go
+++ b/internal/configuration/database/Database_test.go
@@ -100,7 +100,7 @@ func TestApiKey(t *testing.T) {
 	test.IsEqualString(t, keys["newkey"].Id, "newkey")
 	test.IsEqualString(t, keys["newkey"].LastUsedString, "LastUsed")
 	test.IsEqualInt64(t, keys["newkey"].LastUsed, 100)
-	test.IsEqualInt(t, keys["newkey"].Permissions, 20)
+	test.IsEqualBool(t, keys["newkey"].Permissions == 20, true)
 
 	test.IsEqualInt(t, len(GetAllApiKeys()), 2)
 	DeleteApiKey("newkey2")
diff --git a/internal/models/Api.go b/internal/models/Api.go
index 1c3a0e65..3821bdc8 100644
--- a/internal/models/Api.go
+++ b/internal/models/Api.go
@@ -1,10 +1,10 @@
 package models
 
 const (
-	ApiPermView   = 1 << iota // upper case
-	ApiPermUpload             // lower case
-	ApiPermDelete             // capitalizes
-	ApiPermApiMod             // reverses
+	ApiPermView = 1 << iota
+	ApiPermUpload
+	ApiPermDelete
+	ApiPermApiMod
 )
 
 const ApiPermNone = 0
diff --git a/internal/test/testconfiguration/TestConfiguration.go b/internal/test/testconfiguration/TestConfiguration.go
index 12bdfea1..bccb2d87 100644
--- a/internal/test/testconfiguration/TestConfiguration.go
+++ b/internal/test/testconfiguration/TestConfiguration.go
@@ -175,20 +175,24 @@ func writeApiKeyys() {
 	database.SaveApiKey(models.ApiKey{
 		Id:           "validkey",
 		FriendlyName: "First Key",
+		Permissions:  models.ApiPermAll, // TODO
 	})
 	database.SaveApiKey(models.ApiKey{
 		Id:             "GAh1IhXDvYnqfYLazWBqMB9HSFmNPO",
 		FriendlyName:   "Second Key",
 		LastUsed:       1620671580,
 		LastUsedString: "used",
+		Permissions:    models.ApiPermAll, // TODO
 	})
 	database.SaveApiKey(models.ApiKey{
 		Id:           "jiREglQJW0bOqJakfjdVfe8T1EM8n8",
 		FriendlyName: "Unnamed Key",
+		Permissions:  models.ApiPermAll, // TODO
 	})
 	database.SaveApiKey(models.ApiKey{
 		Id:           "okeCMWqhVMZSpt5c1qpCWhKvJJPifb",
 		FriendlyName: "Unnamed Key",
+		Permissions:  models.ApiPermAll, // TODO
 	})
 }
 
@@ -328,7 +332,7 @@ var configTestFile = []byte(`{
    "Port":"127.0.0.1:53843",
   "ServerUrl": "http://127.0.0.1:53843/",
   "RedirectUrl": "https://test.com/",
-  "ConfigVersion": 15,
+  "ConfigVersion": 16,
   "LengthId": 20,
   "DataDir": "test/data",
   "MaxMemory": 10,
diff --git a/internal/webserver/api/Api.go b/internal/webserver/api/Api.go
index 58caa59d..7deae73d 100644
--- a/internal/webserver/api/Api.go
+++ b/internal/webserver/api/Api.go
@@ -240,6 +240,8 @@ func isAuthorisedForApi(w http.ResponseWriter, request apiRequest) bool {
 	return false
 }
 
+// TODO investigate  superfluous response.WriteHeader call from github.com/forceu/gokapi/internal/webserver/api.sendError (Api.go:244)
+// Probably from new API permission system
 func sendError(w http.ResponseWriter, errorInt int, errorMessage string) {
 	w.WriteHeader(errorInt)
 	_, _ = w.Write([]byte("{\"Result\":\"error\",\"ErrorMessage\":\"" + errorMessage + "\"}"))
diff --git a/internal/webserver/api/Api_test.go b/internal/webserver/api/Api_test.go
index 0cf19ae9..27697c2d 100644
--- a/internal/webserver/api/Api_test.go
+++ b/internal/webserver/api/Api_test.go
@@ -32,6 +32,8 @@ func TestMain(m *testing.M) {
 	os.Exit(exitVal)
 }
 
+// TODO test new permission system
+
 const maxMemory = 20
 
 var newKeyId string
@@ -56,13 +58,13 @@ func TestDeleteKey(t *testing.T) {
 }
 
 func TestIsValidApiKey(t *testing.T) {
-	test.IsEqualBool(t, IsValidApiKey("", false), false)
-	test.IsEqualBool(t, IsValidApiKey("invalid", false), false)
-	test.IsEqualBool(t, IsValidApiKey("validkey", false), true)
+	test.IsEqualBool(t, IsValidApiKey("", false, models.ApiPermNone), false)        // TODO permission
+	test.IsEqualBool(t, IsValidApiKey("invalid", false, models.ApiPermNone), false) // TODO permission
+	test.IsEqualBool(t, IsValidApiKey("validkey", false, models.ApiPermNone), true) // TODO permission
 	key, ok := database.GetApiKey("validkey")
 	test.IsEqualBool(t, ok, true)
 	test.IsEqualBool(t, key.LastUsed == 0, true)
-	test.IsEqualBool(t, IsValidApiKey("validkey", true), true)
+	test.IsEqualBool(t, IsValidApiKey("validkey", true, models.ApiPermNone), true) // TODO permission
 	key, ok = database.GetApiKey("validkey")
 	test.IsEqualBool(t, ok, true)
 	test.IsEqualBool(t, key.LastUsed == 0, false)