diff --git a/C4/Auth.pm b/C4/Auth.pm
index 963584a185..2a3c492011 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1606,7 +1606,11 @@ sub check_api_auth {
   ($status, $sessionId) = check_api_auth($cookie, $userflags);
 
 Given a CGISESSID cookie set during a previous login to Koha, determine
-if the user has the privileges specified by C<$userflags>.
+if the user has the privileges specified by C<$userflags>. C<$userflags>
+is passed unaltered into C<haspermission> and as such accepts all options
+avaiable to that routine with the one caveat that C<check_api_auth> will
+also allow 'undef' to be passed and in such a case the permissions check
+will be skipped altogether.
 
 C<check_cookie_auth> is meant for authenticating special services
 such as tools/upload-file.pl that are invoked by other pages that
@@ -1701,7 +1705,7 @@ sub check_cookie_auth {
             return ( "expired", undef );
         } else {
             $session->param( 'lasttime', time() );
-            my $flags = haspermission( $userid, $flagsrequired );
+            my $flags = defined($flagsrequired) ? haspermission( $userid, $flagsrequired ) : 1;
             if ($flags) {
                 return ( "ok", $sessionID );
             } else {
diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm
index 71ef60a277..92cafc22f2 100644
--- a/Koha/REST/V1/Auth.pm
+++ b/Koha/REST/V1/Auth.pm
@@ -189,7 +189,7 @@ sub authenticate_api_request {
         # Manually pass the remote_address to check_auth_cookie
         my $remote_addr = $c->tx->remote_address;
         my ($status, $sessionID) = check_cookie_auth(
-                                                $cookie, '*',
+                                                $cookie, undef,
                                                 { remote_addr => $remote_addr });
         if ($status eq "ok") {
             my $session = get_session($sessionID);