Well, I know that it's a little late, but I will answer it in such a way that I hope other people with this problem can be helpful.
The REST process has its own security configuration, which must be configured in addition to the user of the web interface. These are different configurations and settings in different places. The REST configuration uses the same users that you configured in the web interface, and simply does not use the access rules that you would configure.
To configure permissions, you need to edit the file in the [Geoserver_data} / security directory with the name rest.properties.
See here and here about what to add and edit in this file to provide access to other services.
source share