Any ideas on why I would get the following when running a render.mergeEmail() in a RESTlet? I have this working using another (non-administrator) role. I just can't pinpoint which permission this other role needs.

var mergeResult = render.mergeEmail({
    templateId: templateId,
    entity: {
        type: 'contact',
        id: orderedBy
    },
    recipient: null,
    supportCaseId: null,
    transactionId: tranID,
    customRecord: null
});

{"name":"INSUFFICIENT_PERMISSION","message":"For security reasons, only an administrator is allowed to edit an administrator record."}