Hello Romano,
Thank you for the clear description. What you describe matches an intended change in version 2026.3.0, not a bug. Since that version, Invoke-PSUEndpoint applies the endpoint's roles to the user who makes the call, as a direct HTTP request does.
I reproduced it in our lab on 2026.3.3 with the Permissive model. A user with only the Execute role called an endpoint that runs Invoke-PSUEndpoint against an endpoint requiring Administrator. The server refused the inner call with a 403, and the cmdlet threw exactly your error, with and without -Integrated. Our test used one API endpoint calling another, so if your application still fails after a change below, please send me its exact error and the time of the call.
These two configurations made the call work in the lab.
1. Have the application call the endpoints with its own app token. In the Admin Console, under Secure > Application Tokens, create a token with the endpoint's role. The call also needs permission to execute APIs, which the built-in Administrator, Operator and Execute roles have by default, so if the endpoint's role lacks that permission, add the Execute role to the token too. In the lab, a token with only a custom role was refused with "Permission denied", and the same role plus Execute worked. Pass the token with your server's base URL, held in $ServerUrl below. Without -ComputerName, the call failed with "Specify a computer name or use the Connect-PSUServer command".
Invoke-PSUEndpoint -Url '/your/endpoint' -AppToken $AppToken -ComputerName $ServerUrl
Inside the called endpoint, $Identity is then the token's identity and no longer the application's user. Every user of the application can run those endpoints through it, and the calls fail again once the token expires.
2. Add a role that your application's users already have to the endpoint's Roles. In the lab, an endpoint with the roles Administrator and Execute ran for an Execute user, both through Invoke-PSUEndpoint from another endpoint and over HTTP. Those users can then also call the endpoint directly.
Both topics are described in the documentation.
https://docs.devolutions.net/powershell-universal/api/security/
https://docs.devolutions.net/powershell-universal/security/app-tokens/
Best regards,
Michel
