Fibaro support:
It is exactly like you are saying. Unless you are admin you can’t call the API.
I will forward your case to our developers but unfortunately as a support engineer I cannot specify when or if this feature will be implemented.
In my opinion a major security flaw.
Roger