Authentication for iControl REST vs bigsuds/python icontrol

It looks like the SOAP-based iControl library requires a user have GUI access, which includes "auditor" role read-only access. iControl REST, however, seems to require "administrator" role with advanced shell access. Is this correct? I'm particularly puzzled by this as iControl mimics tmsh commands, so I'd expect it to just require tmsh privs.

Is there a way to have REST access with the credentials of a read-only "auditor" or "partition manager" role user?

Thanks!