Are you using basic auth, or client credentials (oauth)?
Have you tried removing the user from the workgroup, and just assigning those two capabilities directly?
Are you using basic auth, or client credentials (oauth)?
Have you tried removing the user from the workgroup, and just assigning those two capabilities directly?