[api] Allow users with read-only access to access /api/orders/:num