Page History

...

Command level security access is the lowest level of access you can configure by role for REST endpointsonly applies to the commands endpoint. 

Role-based access to specific commands can be are configured in the rest-services module: /modules/rest-services/rest-endpoints/commands/enabledCommands/ 

...

• If the user is not granted access to the requested node, the endpoint returns the HTTP response code 401, 403, 404 or 500 depending on the casethe endpoint responds with an HTTP error.
• If JCR security access is granted, the endpoint returns the HTTP responds with an HTTP response code 200 and a response body if appropriate.

...