Settings live at /m02-p/naked/param-role/api/settings. The endpoint decides whether to return admin settings by reading a role the client sends - a ?role= query param, an X-Role header, or a role cookie - instead of the server session. Claim to be admin.