My REST API call returns data fine as long as the user has 'view all contacts' permission. But if I turn that off and instead grant the user access to a particular group via an ACL, I get nothing. I've confirmed that the user can see the relevant data through the UI.
Should that work? Or are ACLs not taken into account by the REST API?
Using WordPress and Civi 4.5.8.
Update 1: this issue on the forum suggests it might not be WordPress specific.
Update 2: Just to clarify exactly what I'm doing, here's the relevant part of the URL:
I can get the data I want by using the API key of an admin, or if a non-admin has 'View all contacts' permission. But I get no results if the non-admin lacks this permission and only has access via an ACL. (If I change the API key I get an authentication error, so I'm confident that's correct.)