The REST Web Service command API does not consider folder permissions.
Folder permissions should be considered when a method of the commands API is called.