Only available to administrators.

Guarded by admin:access rather than a notice-specific permission, and that is deliberate. A new permission is created by the RBAC seed but not added to any existing role -- roles keep their configured permission sets unless the seed is run with reset, which would discard an instance's customisations. The endpoint would then be callable by nobody on precisely the instances that have been running longest, and would be found out during the incident someone was trying to announce.