The patrons endpoint now requires only 'list_borrowers' for GET requests The patrons/account endpoint requires "edit_borrowers" and "updatecharges:remaining_permissions" which is really view only The edit_borrowers in the second should be "list_borrowers" so that outside systems can view charges without needing to be able to edit patrons.