are there any other permissions required to apply an ingest rules on a cloudflare tunnel via the API? It seems to be adding it as a public hostname, but not as a route and im getting super confused.