Make IBM Cloud CLI and API authorizations consistent

I usually use IBM Cloud CLI, and I am trying to use APIs for some specific commands I would like to run right from IBM i or AIX running in Power Virtual Server.

Unfortunately I have found we need special authorities for APIs that should be simple. My first attempt was to get the console URL from a VSI, and I have found this message:

please contact your account administrator. This endpoint requires one of the following IAM action: [power-iaas.cloud-instance.read power-iaas.pvm-instance-console.create]

This IAM actions are not required with the CLI.

Please, make both tools use same authorities in IAM, specially with read-only commands.