Add foreign key validation

Currently the api does not validate if any provided foreign key (project/permission_group_id) actually exists.

Should be added.