by Nathan Loudon.
I think it was this line that guided me to the solution:
Check user capability: The user should have appropriate capabilities according to the protocols used, for example webservice/rest:use, webservice/soap:use. To achieve this, create a web services role with protocol capabilities allowed and assign it to the web services user as a system role.
If you go here /admin/roles/manage.php and add a role, and give it the capabilities you require, mine is currently:
usersmoodle/user:create
tokenmoodle/webservice:createtoken
settingsmoodle/course:update
participationmoodle/course:view
coursesmoodle/course:viewhiddencourses
protocolwebservice/rest:use
But only give it what it needs for your application.
Then assign that role to your API user.
Check user capability: The user should have appropriate capabilities according to the protocols used, for example webservice/rest:use, webservice/soap:use. To achieve this, create a web services role with protocol capabilities allowed and assign it to the web services user as a system role.
If you go here /admin/roles/manage.php and add a role, and give it the capabilities you require, mine is currently:
usersmoodle/user:create
tokenmoodle/webservice:createtoken
settingsmoodle/course:update
participationmoodle/course:view
coursesmoodle/course:viewhiddencourses
protocolwebservice/rest:use
But only give it what it needs for your application.
Then assign that role to your API user.