Missing permissions when creating an API token

I noticed that there are no update permissions on https://ploi.io/profile/api-keys/modals/create, but https://developers.ploi.io/sites/update-site for example shows there’s an update site endpoint. Should we use the create permission for this? If yes I want to suggest adding a more restricted update permission.

In addition to that there are endpoints in general without a matching permission. E.g there exists https://developers.ploi.io/projects/, but no project permission. Am I mission something or is this an error? If so, add the corresponding permissions and/or show which permission is needed on the endpoint page.