API User minimum role & using user/pwd to access api

[rahy]

1. What is the minimum Role for a User that is only used for accessing API (token generated for that user)?

2. Can we do CRUD and RPC with user/pwd only (not user token)?