The first thing to check is if the way you call the RESTlet and execute the search is the same way you do with the user Role and permissions wise.