I’ve configured user permissions setting for object access as following.
But when I use API with OAuth access token, I can update objects with restricted user accounts. It seems that object access permissions does not affect API request.
How can I configure permissions for API request? (with same OAuth scope)
At this time you would need Super Admin permission in order to perform API request at this time.This would allow you have access to the API key as well.