API user accounts are the same as regular user accounts. That is, accounts that will be used for an API application are also created and maintained using the swAdmin2 client. Accounts using the SystemWeaver API can be read-only or read/write. Just like with regular accounts, when you create the account, you can assign the "Viewer" role to it and it will be limited to read-only for items. However, note that the "Viewer" roll does not limit the account using the SystemWeaver API to read-only for Issues if you give the account access to a CMS Project.