REST-API does not expose list password
As mentioned in the irc the emails sent to moderators about held messages include a note about using an Approve header with the list password to accept the message.
The list password is available in the database yet not exposed via the REST API.
Because of that postorius has no way of accessing it.