API for end-device forbids at least mac_settings and session

I’m trying to retrieve “mac_settings” and “session” via API, according to

https://www.thethingsindustries.com/docs/reference/api/end_device/#message:EndDevice

this should be exposed. Have created 2 API keys, one some kind of read-only, the other one with all permissions. Both are not permitted to retrieve data

GET /api/v3/applications/{APP}/devices/{DEV}?field_mask=name,description,locations,last_seen_at,mac_settings,session HTTP/2
...
{"code":3,"message":"error:pkg/rpcmiddleware/validator:field_mask_paths (forbidden path(s) in field mask)","details":[{"@type":"type.googleapis.com/ttn.lorawan.v3.ErrorDetails","namespace":"pkg/rpcmiddleware/validator","name":"field_mask_paths","message_format":"forbidden path(s) in field mask","attributes":{"forbidden_paths":["mac_settings","session"]},"correlation_id":"***","code":3}]}

It’s only successful once “mac_settings,session” is removed.

Via ttn-lw-cli and “admin” login it’s working.

Thank you already for any useful hint!