Creation of next available IP address via REST API requires extraneous permission

[jeremystretch]

Environment

• Python version: 3.6.9
• NetBox version: 2.8.5

Steps to Reproduce

1. Create a user with permission to create IP addresses but not prefixes
2. Assign the user a REST API token with write ability
3. Create a new prefix and note its numeric ID
4. Make the following API call in an attempt to create an available IP address within the prefix:

curl -X POST \
-H "Authorization: Token  $TOKEN" \
-H "Content-Type: application/json" \
-H "Accept: application/json; indent=4" \
http://localhost:8000/api/ipam/prefixes/$PREFIX_ID/available-ips/

Expected Behavior

A 201 response should be received indicating the creation of a new IP address.

Observed Behavior

Received a 403 error indicating lack of permission to perform this operation. After assigning the user permission to create a prefix, the request succeeds as expected.