The API v1 and v2 actions are not currently assigned to permissions (with the exception of just four API v1 controllers), so it requires an admin account to perform most work over the API.

The actions for API controllers should be added to permissions and tests added (by fixing test/lib/foreman/access_permissions_test.rb to test for them), or perhaps a method of equating API routes to standard app routes to avoid repeating them.