The capability names exposed by these endpoints are implementation details of the DefaultPermissionBackend. A different implementation may choose to hide the GlobalPermission enum names from the user entirely, so it doesn't make sense to expose them. Change-Id: I69ea38064ccbf1c04a976e7bcb4629ab5d66aeef