You can't currently place an order via POST /orders/composite-orders when having only the orders.item.post permission...
As you can see below orders-storage.purchase-orders.collection.get permission is absent from the modulePermissions section of this endpoint.
- You should be able to place an order while having only the orders.item.post permission.
- You receive the error message above.
- The needed permission has been added to the modulePermissions section of the appropriate endpoint in the module descriptor.