How to use metadata with the REST API?

We're using endpoints to write metadata with calls like

'/restapi/vc/messages/id/xxx/metadata/key/foo.bar/set/?value=yyy'

and I'd love to search on those with calls like

'/restapi/vc/posts/for/metadata/key/foo.bar/value/true'

but I'm actually not getting any results with that call. If I try to retrieve the metadata value with

'/restapi/vc/posts/for/metadata/key/foo.bar/value/true'

then I just get a 303 permission denied error.

However, if you have custom tags enabled you can search for metadata with the key 'modbar.<customtag>' and it works.

So is there a permissions model for metadata? Can you set certain keys to be readable/writeable by users?