5.38Object security matters

Just because:

Account.Secret_Field__c

exists doesn't mean your integration user can read it.

Likewise, having an Update operation doesn't mean the integration user can modify every field.

Potential problems:

object permission
field-level security
record access
sharing
API permissions

So:

works for admin

does not prove:

works for Mule integration user

That's important both in development and testing.