The REST api for holds CRUD should require hold permissions! I think it needs reserveforothers and it's subpermissions implemented.
This issue is fixed in Bug 14868, however it does not directly duplicate this bug since Bug 14868 (Swagger2-driven permission checking) is last of three changes that modify the Swagger-specification aiming towards more split specification including the introduction of permissions in Path-object. Here are short descriptions for the three Bugs:
1. Bug 16212 adds a "minifier"-script to Swagger that fixes problems the current way of splitting swagger.json in master has caused; the problem is that splitting the "definitions" to $ref: definitions/index.json is not allowed (same with Paths-object) in Swagger. If we use a script to resolve the references in swagger.json, it becomes valid. You can see this problem if you try to validate our master Swagger specification with online.swagger.io validator.
2. Bug 16699 (depends on 16212) splits swagger.json further than what has already been done, and uses the minifier to make this type of split allowed.
3. Bug 14868 fixes the issue reported in this bug, but is dependant on Bug 16699.
It would be cool if someone took a look at them. I'm adding it as See Also. :)
I mark it for 16.05 as the REST api has been enabled in that branch's latest release. And the proper solution for master what Lari mentions: bug 14868.
I'll start working on it.
*** This bug has been marked as a duplicate of bug 14868 ***