src/main/resources/roles/external-applications contains:
ROLE_API_GOURPS_CREATE
Should be
ROLE_API_GROUPS_CREATE
As well as the change in external-applications, this should have a conversion script to update existing dbs,
update mh_role set name='ROLE_API_GROUPS_CREATE' where name='ROLE_API_GOURPS_CREATE';
Note that the role name is correct in documentation and security config:
~/matterhorn $ grep -r ROLE_API_GROUPS_CREATE *
docs/guides/admin/docs/configuration/external-api.md:|ROLE_API_GROUPS_CREATE |POST |/api/groups |
etc/security/mh_default_org.xml: <sec:intercept-url pattern="/api/groups" method="POST" access="ROLE_ADMIN, ROLE_API_GROUPS_CREATE"/>