API Use for Self Install

Is it possible for me to use the api to update my customers in my self installed akaunting set up?

I have an airtable for my crm and I wanted to use my n8n install to add a new customer to akaunting when a new customer is added in airtable.
The airtable is udated from all forms of contact from website and whatsapp.

Self-hosted API: POST to /api/contacts returns 403 "User does not have any of the necessary access rights", but GET (including GET-based write actions like /enable) works fine with the same user

Akaunting self-hosted, Laravel 10.50.3, authenticating via HTTP Basic Auth (email/password) against /api/... routes.

GET /api/companies → works
GET /api/companies/{id}/enable → works (a write action, but GET verb)
POST /api/contacts with {"type":"customer","name":"...","email":"...","currency_code":"GBP","enabled":true} → {"message":"User does not have any of the necessary access rights.","status_code":403}
Same 403 even with an empty {} body, so it's not content-triggered

I confirmed via php artisan tinker that the authenticated user (admin role) has both read-api and create-sales-customers permissions ($user->hasPermission([...]) returns true for both). So the role/permission system itself says yes, but something in the request pipeline still blocks POST/PUT specifically while GET passes.

Enabling APP_DEBUG/API_DEBUG didn't add a trace to the JSON response, and I couldn't find a route-level permission: or ability: middleware applied differently per HTTP verb in routes/api.php or Kernel.php — the whole contacts resource shares one api middleware group.

The 403 behavior is interesting, especially since the same admin user can read the API and even trigger some write actions through GET. I’d check whether the POST route is applying a separate permission or ability check before the request reaches the controller. That would also explain why the n8n integration fails even though the user has the expected permissions.