Hi,
I cannot find an answer neither in the documentation nor this forum so I would like to ask, what are the default restrictions for RW ROR users (e.g. ldap) in KBN API usage, if there are any? 
Is every KBN user able to run any available (GET|PATCH|POST|PUT|DELETE) for “kbn:/api/*”?
Hello @mikeIT
Is every KBN user able to run any available (GET|PATCH|POST|PUT|DELETE) for “kbn:/api/*”?
By default, yes, any authenticated user can call any HTTP method (GET/PUT/PATCH/POST/DELETE) against kbn:/api/*. There’s no per-method restriction applied at the Kibana proxy layer for regular RW/RO access levels.
If you need to restrict specific Kibana API endpoints for a user, that’s done via accessLevel: api_only + allowed_api_paths — see the docs: For Elasticsearch | ReadonlyREST