accept permissions params for api-tokens

packages/core/admin/server/controllers/api-token.js

@@ -24,6 +24,7 @@ module.exports = {
       name: trim(body.name),
       description: trim(body.description),
       type: body.type,
+      permissions: body.permissions,
     };
 
     await validateApiTokenCreationInput(attributes);

packages/core/admin/server/validation/api-tokens.js

@@ -15,6 +15,10 @@ const apiTokenCreationSchema = yup
       .string()
       .oneOf(Object.values(constants.API_TOKEN_TYPE))
       .required(),
+    permissions: yup
+      .array()
+      .of(yup.string())
+      .nullable(),
   })
   .noUnknown();
 
@@ -30,6 +34,10 @@ const apiTokenUpdateSchema = yup
       .string()
       .oneOf(Object.values(constants.API_TOKEN_TYPE))
       .notNull(),
+    permissions: yup
+      .array()
+      .of(yup.string())
+      .nullable(),
   })
   .noUnknown();