Thank you for your reply. 
The “ignoring permission” is set in the android app, but not in my linux syncthing.
I am feeling a bit lost at the rest results, since I don’t get the same result as shown in the docs.
curl -X GET -H “X-API-Key: xxx” http://localhost:8080/rest/db/file?folder=finanzen&file=data.mmb
[1] 29817