I think the bug is that we require authorization on these calls in our default policy.json configuration.
I think the bug is that we require authorization on these calls in our default policy.json configuration.