The request MUST provide either citizenId or externalRef or both.

If both citizenId and externalRef are provided, they must resolve to the same Citizen.

If the validity range (validStart to validEnd) is omitted, the server timestamp will be used for both.

If only validStart is provided, then the validity range will be from validStart until now.

If only validEnd is provided, then the validity range will be from now until validEnd.

Only permissions that are valid from the start and still valid at the end of the range will be returned.
Permissions without a validUntil date will be considered valid from their start date until the end of time.