1 person found this helpful
In general, you either need to be a Full Access admin to execute this on behalf of other people, or you need to be logged as the person (ideally with an OAuth Token)
See: Core V3 API - Run-As Feature & Signed Add-Ons for Run-As capabilities
See: OAuth 2.0—Creating a Client and Managing Access for more details.
It all depends on how you call the API (specifically, who you are connect as when you call it).
Hope that helps.