diff --git a/workflow/engine/src/ProcessMaker/Services/Api/Calendar.php b/workflow/engine/src/ProcessMaker/Services/Api/Calendar.php
index 0c31706b4..e12490240 100644
--- a/workflow/engine/src/ProcessMaker/Services/Api/Calendar.php
+++ b/workflow/engine/src/ProcessMaker/Services/Api/Calendar.php
@@ -14,26 +14,9 @@ class Calendar extends Api
     private $formatFieldNameInUppercase = false;
 
     /**
-     * Constructor of the class
-     *
-     * return void
-     */
-    public function __construct()
-    {
-        try {
-            $user = new \ProcessMaker\BusinessModel\User();
-
-            $usrUid = $this->getUserId();
-
-            if (!$user->checkPermission($usrUid, "PM_SETUP")) {
-                throw new \Exception(\G::LoadTranslation("ID_USER_NOT_HAVE_PERMISSION", array($usrUid)));
-            }
-        } catch (\Exception $e) {
-            throw new RestException(Api::STAT_APP_EXCEPTION, $e->getMessage());
-        }
-    }
-
-    /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_CALENDAR}
      * @url GET
      */
     public function index($filter = null, $start = null, $limit = null)
@@ -50,6 +33,9 @@ class Calendar extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_CALENDAR}
      * @url GET /:cal_uid
      *
      * @param string $cal_uid {@min 32}{@max 32}
@@ -68,6 +54,9 @@ class Calendar extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_CALENDAR}
      * @url POST
      *
      * @param array $request_data
@@ -91,6 +80,9 @@ class Calendar extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_CALENDAR}
      * @url PUT /:cal_uid
      *
      * @param string $cal_uid      {@min 32}{@max 32}
@@ -109,6 +101,9 @@ class Calendar extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_CALENDAR}
      * @url DELETE /:cal_uid
      *
      * @param string $cal_uid {@min 32}{@max 32}
diff --git a/workflow/engine/src/ProcessMaker/Services/Api/ProcessCategory.php b/workflow/engine/src/ProcessMaker/Services/Api/ProcessCategory.php
index 772c1c0ad..d83b2f91e 100644
--- a/workflow/engine/src/ProcessMaker/Services/Api/ProcessCategory.php
+++ b/workflow/engine/src/ProcessMaker/Services/Api/ProcessCategory.php
@@ -21,13 +21,6 @@ class ProcessCategory extends Api
     public function __construct()
     {
         try {
-            $user = new \ProcessMaker\BusinessModel\User();
-
-            $usrUid = $this->getUserId();
-
-            if (!$user->checkPermission($usrUid, "PM_SETUP")) {
-                throw new \Exception(\G::LoadTranslation("ID_USER_NOT_HAVE_PERMISSION", array($usrUid)));
-            }
 
             $this->category = new \ProcessMaker\BusinessModel\ProcessCategory();
 
@@ -38,6 +31,9 @@ class ProcessCategory extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_PROCESS_CATEGORIES}
      * @url GET /categories
      */
     public function doGetCategories($filter = null, $start = null, $limit = null)
@@ -52,6 +48,9 @@ class ProcessCategory extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_PROCESS_CATEGORIES}
      * @url GET /category/:cat_uid
      *
      * @param string $cat_uid {@min 32}{@max 32}
@@ -68,6 +67,9 @@ class ProcessCategory extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_PROCESS_CATEGORIES}
      * @url POST /category
      *
      * @param array $request_data
@@ -88,6 +90,9 @@ class ProcessCategory extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_PROCESS_CATEGORIES}
      * @url PUT /category/:cat_uid
      *
      * @param string $cat_uid      {@min 32}{@max 32}
@@ -103,6 +108,9 @@ class ProcessCategory extends Api
     }
 
     /**
+     * 
+     * @access protected
+     * @class  AccessControl {@permission PM_SETUP_PROCESS_CATEGORIES}
      * @url DELETE /category/:cat_uid
      *
      * @param string $cat_uid {@min 32}{@max 32}