What minimum permissions are required for a given user to be allowed to make REST calls?