I used these commands in 2017, don't know how relevant they are now. But, following should suffice to give user API access.
security login role create –role vrnsrole –cmddirname “vserver fpolicy” –vserver SVM_NFS
security login role create –role vrnsrole -cmddirname “volume” –vserver SVM_NFS –access all
security login role create –role vrnsrole –cmddirname “vserver” – vserver SVM_NFS –access all
security login role create -role vrnsrole -cmddirname "version" – vserver SVM_NFS -access all
To grant ONTAPI access for the NetApp cluster for an Active Directory user, run the following command on the cluster console:
security login create –vserver <vservername> -username <domain\username> -application ontapi -authmethod domain -role <rolename>