On the 29th of November 2017, we will be merging PR 7710 which will add support for permissions within the API.
This means, any users who have a token generated for them which are not admin users will no longer be able to make all the API calls they could previously. Please check your API tokens and user privileges to ensure that everything is setup correctly.
The API will now follow the same validation as the WebUI so if you provide an API token for a normal user then they will only be able to access the devices, ports and/or bills you have configured.