Nope. They refer to the permissions of the smart proxy controller https://github.com/iNecas/katello/blob/capsule-api/app/controllers/katello/api/v2/capsules_controller.rb#L43. Also, undefined matches always result with 403, if this was the case