Hi there,
Thanks for reaching out to us.
In the API Key authentication method, we use the subscriber role and It does not have capabilities to modify the records. If you want to modify the records you can use the Basic Authentication, JWT Authentication or OAuth 2.0 authentication method.
If you use another method you have to take care that the user you are passing for the authentication has the capabilities to update or create those records or REST APIs.
Let us know if you find any difficulty we’d be happy to help you.
Thank you
miniOrange