@pauldix that gets checked inside the coordinator currently - for all other API actions as well. Right now it won't let non-admin users query their own details. Do you think that's important to allow?