The API tells you "which resources does a subject have access to under a specific permission". Yes, it is required. If you want to retrieve all resources for all permissions, you have to perform one Lookup resources call for permission and resource_type pair