RESTfull approach to validate permission to access resource

Question

I am thinking about how to design (probably new) endpoint in my REST API.

At the moment, I have these two endpoints:

GET /contracts

G