Minimum authorization role to just access Web Service hosted on PI

Hi All,

I need to know the minimum authorization role required for creating a USER that can be shared with other end users/ third party client for consuming a web service hosted in PI.

Is there any role/s, to just invoke the WS and which doesn't allow any access to edit IR, ID, SLD, etc, objects.

Thanks in advance,

Shashank