Had to add so REST Api can access the accounts/<account-id>/external.ids endpoint, per https://gerrit-review.googlesource.com/Documentation/access-control.html#capability_modifyAccount
diff --git a/project.config b/project.config
index 4885a76..dd07e59 100644
--- a/project.config
+++ b/project.config
@@ -17,6 +17,7 @@
 	streamEvents = group Non-Interactive Users
 	accessDatabase = group user/Brian O'Connor (bocon)
 	accessDatabase = group user/HungWei Chiu (hwchiu)
+	modifyAccount = group Administrators
 [access "refs/*"]
 	read = deny group GitHub Replication - Open-Cloud
 	read = deny group GitHub Replication - OpenCord