API, create_labels_if_missing permissions

We have a vendor connecting to Monday.com via API.

The create_labels_if_missing argument requires permission to change the board structure for status columns.

I need help understanding where and how the permissions should be set.

  1. Do the board permissions need to be set to Edit Everything? We prefer not to allow all board subscribers the ability to change status columns/Board Structure.
  2. Is it possible that only the subscriber who generated the API Key needs permission to change status columns?

I would greatly appreciate any help in understanding how we protect the board structure while allowing the create_labels_if_missing argument to work.