Why do I need so extensive permissions for getting event participant via API?
I'm not sure what context you are doing this in, but since you are calling the API from php, you can pass in the param 'check_permissions' =&gt; FALSE to bypass the ACLs for the logged in user. This is useful when you know you want to get something from the api that the logged in user wouldn't normally be able to access. Just be careful!