Page History

...

Web permissions are granted with as web access lists - they  per role. They grant access to a path for Get or Get & Post. You can grant web access per role. 

• Get – Grants the HTTP method GET for a given URI.
• Get & Post – Grants the HTTP methods GET, PUT, POST and DELETE for a given URI.

...

JCR access security is a feature of the JCR standard (defined by JCR JSR-170 and JSR-283). JCR access is granted per workspace on path level. It can grant Read-only or Read/Write permission. You can grant  Grant JCR access per role.

When using endpoints dealing with JCR repositories (nodes and properties to read and write, delivery to read only) the user must have an appropriate role that provides JCR permissions for the given method.

...