Does the role have Transactions > Sales Order permission? What other results are coming from the search? Maybe if you're bringing in Sales Rep and Customer information, the API user will need view access to those types of records as well? Also check the permissions on the search itself to see if they have permission to run it