docs(api): note the zone metadata permission on zone updates and who may list templates

Author: edmondas

docs/api/endpoints.md

@@ -44,6 +44,12 @@ API v2 is the recommended version. All paths are prefixed with `/api/v2`.
 | `POST` | `/zones/{id}/owners` | Add owner(s), supports batch (v4.2.0+) |
 | `DELETE` | `/zones/{id}/owners/{user_id}` | Remove owner (v4.2.0+) |
 
+From v4.2.6, v4.3.5, v4.4.1 and v4.5.0, changing a zone's `name`, `type` or `master` through
+`PUT /zones/{id}` requires the zone metadata permission (`zone_meta_edit_own` or
+`zone_meta_edit_others`), the same gate as the web edit form; record content permissions alone
+return `403`. A value that matches what is stored is not treated as a change, so clients that
+resend every field on update keep working.
+
 #### Setting the serial policy on create (v4.5.0+)
 
 `POST /zones` accepts an optional `soa_edit_api` string that sets the zone's
@@ -249,6 +255,10 @@ content against the record type and returns `400` with the validator message whe
 See [Record validation](../user-guide/dns-templates.md#record-validation) for the rules,
 including where MX and SRV priority belongs.
 
+From the same releases, `GET /zone-templates` and `GET /zone-templates/{id}/records` are also
+readable with `zone_master_add` or `zone_slave_add`, matching the add-zone form, which offers
+templates to anyone who may add a zone. Writing a template still needs the template permissions.
+
 ## Health endpoints (v4.5.0+)
 
 These sit outside the versioned API and outside the API key model. They take no

docs/user-guide/permissions.md

@@ -214,7 +214,7 @@ templates above.
 
 - Allows the user to create new zone templates
 - Also required to save an existing zone's records as a new template
-- Together with `zone_templ_edit`, gates access to the zone template list
+- Together with `zone_templ_edit`, gates access to the zone template list; from 4.2.6, 4.3.5, 4.4.1 and 4.5.0 the API template listing is also readable with `zone_master_add` or `zone_slave_add`
 
 ### zone_templ_edit