Your API key must have the Edit plugins permission for write operations (create, update, and delete). For read endpoints, your API key’s effective role must be greater than or equal to the plugin’s minimumRoleRequired setting — if it is not, read endpoints will return 403 Forbidden for existing plugins or an empty result set.
