Tampering with a JWT

An API uses JWTs. You decode the token, change "role":"user" to "role":"admin", re-encode it without re-signing, and call an admin endpoint. What result shows the API is secure?