These things are hard to debug remotely. Actually, impossible. That said, here's a few things to tackle.

1) Can you impersonate as the API user (or user with identical roles/groups)   then try to do that edit via the UI? Might expose some ACL problems which seems like you already suspect.

2) Double check that some business rule is not changing the value out from under you.

3) Double check your ACLs. A baseline instance shouldn't have anything that is doing this, but someone might have modified something.

4) Double check that you are passing in the exact value (not name) via the integration. Check for some sort of weird coercion in integration code if that is possible. If you are passing a value that doesn't exist, that will just get ignored.

Let me know if any of this helps.