Merge branch 'AC-12818' into cia-2.4.8-beta2-develop-bugfix-10212024

Author: pawan-adobe-security

app/code/Magento/Sales/etc/acl.xml

@@ -14,6 +14,7 @@
                         <resource id="Magento_Sales::sales_order"  title="Orders" translate="title" sortOrder="10">
                             <resource id="Magento_Sales::actions" title="Actions" translate="title" sortOrder="10">
                                 <resource id="Magento_Sales::create" title="Create" translate="title" sortOrder="10" />
+                                <resource id="Magento_Sales::api_actions" title="Order Save API" translate="title" sortOrder="10" />
                                 <resource id="Magento_Sales::actions_view" title="View" translate="title" sortOrder="20" />
                                 <resource id="Magento_Sales::email" title="Send Order Email" translate="title" sortOrder="30" />
                                 <resource id="Magento_Sales::reorder" title="Reorder" translate="title" sortOrder="40" />

app/code/Magento/Sales/etc/webapi.xml

@@ -256,7 +256,7 @@
     <route url="/V1/orders" method="POST">
         <service class="Magento\Sales\Api\OrderRepositoryInterface" method="save"/>
         <resources>
-            <resource ref="Magento_Sales::create" />
+            <resource ref="Magento_Sales::api_actions" />
         </resources>
     </route>
     <route url="/V1/transactions/:id" method="GET">