We didn't have scope: :private specified on settings endpoint which resulted in errors (services check permissions of current user anyway, but it will error out if there is no user available).