The API loads a filter by id without the caller's search limit. The lookup is Api::V2::FiltersController#resource_scope, which returns every filter. The action check only asks whether the caller has the delete permission at all. Nothing checks that specific filter on delete. A filter on a locked built-in role is still rejected.

The caller must be logged in and must hold a permission to delete filters that is limited by a search, for example to one role.

Deletion of a filter on another unlocked role was demonstrated through the API. The same delete through the web interface was refused. An update that moves a filter onto a role inside the caller's search was read from the code and was not demonstrated.