The role needed is 'Standard AXL API Access'. By default, there is no user group with _only_ this permission, so you may want to create one.
Thanks for the help, i have tried with 'Standard AXL API Access' but this role does not have enough permissions. I wounder if our CM has been changed to remove this!
I'll keep digging and let you know.