1. Create a new user (without any group or role assignment so it has no privileges) 2. Get an Access Token for this user via the token endpoint (/auth/realms/<realmName>/protocol/openid-connect/token) 3. Trigger a partial export via HTTP POST /auth/admin/realms/<realmName>/partial-export?exportGroupsAndRoles=true&exportClients=true and the Access Token of the unprivileged user as authorization Current behavior: A realm export is returned. Expected behavior: A HTTP 403 Forbidden is returned, as export should only be possible for realm admin user.