To execute an Appian Web API, the calling user or service account must have a minimum of Viewer permissions to the Web API object. This aligns with the principle of least privilege, granting only the necessary rights to invoke the endpoint without allowing modification. Higher permission levels, such as Editor or Administrator, also permit execution but provide additional capabilities (e.g., editing the object's definition, managing security) that are not required for an end user to simply call the API. Therefore, Viewer is the correct minimum privilege level.

1. Appian Corporation. (2023). Web API Object. Appian 23.4 Documentation. In the "Security" section

it states: "Users must have at least Viewer permissions to the web API to execute it."

2. Appian Corporation. (2023). Object Security. Appian 23.4 Documentation. This document outlines the standard permission levels (Administrator

Editor

Viewer

Deny) and their general functions

reinforcing that Viewer permissions are intended for users who need to see or use an object at runtime without modifying it.