Overall/Administer permission is currently needed to setup additional endpoints.

Based on JEP-223, this operation does not allow users to escalate permissions and it's not related to security, so it qualifies to be accessible with the Overall/Manage permission.