And some endpoints, like bulk deletion, use XML as input. But access control policies are JSON for some reason ¯\_(ツ)_/¯