The MQWebAdmin, MQWebAdminRO and MQWebUser roles can all be used for the admin REST API. That’s why MQWebUser is not called MQWebMessaging – it’s not just for messaging. The difference between them is the user ID that’s checked by the qmgr for operations performed via the REST API.
- Operations performed by users in the MQWebAdmin* roles take place under the context of the mqweb server user ID.
- Operation performed by users in the MQWebUser role take place under the context of the user logged into the REST API.
Thanks to Gwydion for this enlightenment.