public static function permissionList($permissionListStr)
    {
        // make sure the string is valid JSON array containing just strings
        $permissionList = Json::decode($permissionListStr);
        foreach ($permissionList as $permission) {
            if (!\is_string($permission)) {
                throw new InputValidationException('invalid "permissionList"');
            }
        }

        return $permissionList;
    }