How do I read a KSDS record by key without opening the write surface?

GET /dataset-record/by-key with datasetName and keyBase64. It requires RACF Basic but is not write-gated. Missing key returns 404; no RACF permission returns 403. Insert/update/delete on /dataset-record remain write-gated.