5.
Check API permissions (determine list or detail API based on rules)
a. List API
a1. Parameter sport_id (supports multiple, separated by commas) detection.
If this parameter has no value, take the sport_id from permissions as the parameter, pass and forward.
If this parameter has a value, compare with the sport_id from permissions. If it's a subset, pass; if there are non-intersecting elements, fail - no permissions
b. Detail API (path has rules containing sport_id)