Custom API entity permissions
Created by: artfulrobot
Default permission for custom API entities is "Administer CiviCRM" not "Access CiviCRM", if I've read the code correctly.
Also docs were not clear as to separation of the name of the custom API entity and the name of the extension within which the custom API entity was defined; I hope I've made that clearer.
(These things had confused me trying to create a custom API entity that is accessible without Administer CiviCRM)