Wallets, the payment-method catalogue, and the two conversion operations.
These four operations declare no ability, so any valid, unrevoked key of your account reaches them whatever abilities it carries, and 403 insufficient_scope cannot occur on them. A key is still required: an anonymous request is refused with 401 missing_api_key.
The two conversion operations are not interchangeable. A quote is asymmetric and priced — it is what a payer must send. A rate is symmetric and free of both spread and fee — it is an indicative figure. Quoting a payer from the rate operation understates what they owe.