Authenticated ≠authorized: a guest gets 401, a logged-in Editor gets 403 rest_forbidden.
Three wp.org reviews of our plugins, three questions: ①Who may call the route? 4WP Drive T1 — routes checked a global editposts. Fix: capabilities of the import post type, one per action. ② Which object? 4WP TODO T1 — POST /tasks accepted any postid. Fix: edit_post on the target post. ③ How much data comes back? 4WP TODO T2 — GET /meta returned a site-wide user list. Fix: only people and posts on notes the user can already see.
permission_callback answers who may call the route. It does not decide how much data the response may dump.
Go deeper
- Full guide: 4wp.dev/development/rest-api/authentication