My team maintains our company's Salesforce implementation. One of the other engineering teams would like to dynamically retrieve the objects in the org along with their fields. They attempted to use the Metadata API, but ran into an issue: using the Metadata API requires ModifyAllData, but their integration user is on a "Read-Only" profile. It looks to me like using the SOAP API would work, but I've never used it myself, and I'm not sure if they'll run into a similar issue. Does anybody know whether or not they'll be able to use it in this way without ModifyAllData?
The SOAP and REST APIs require the "API Enabled" permission, but nothing more. Note that if the user does not have have the Read permission on an Object, and at least View permission on a field, they will not be described. For example, if you remove the ability to view a custom field, it will no longer appear in their describe calls. The SOAP and REST APIs are designed to be used by external systems (e.g. Chatter Desktop, Salesforce1, Connect for Outlook, etc.) and do not require any extra permissions. See describeGlobal, describeSObjects in the SOAP API, and Describe Global and SObject Describe from the REST API.