WooCommerce REST API consumer key missing dedicated read‑only order notes scope

Administrators aim to issue a WooCommerce REST API consumer key that can retrieve order notes but cannot modify any order data. Currently the API grants access to order notes through the same 'shop_order' read capability that also underpins the edit_shop_orders permission, so a key intended for read‑only note viewing inadvertently allows write operations when the associated user holds edit_shop_orders. There is no built‑in way to split these permissions, and reliance on role‑editor plugins or dedicated users remains a workaround. It is unclear whether the forthcoming REST API v3 roadmap will introduce an explicit read‑only scope for order notes that would resolve this ambiguity.

Is there a method to achieve true read‑only order‑note access via consumer key without granting edit_shop_orders? Does the planned API v3 include a dedicated read‑only order notes permission? How can a store owner verify that a consumer key’s privileges are limited to order notes only in the present version?