Campaign API 403 when mapping Zendesk outbound lists to Genesys Cloud

My current config is completely failing… We are trying to migrate Zendesk outbound campaigns to Genesys Cloud and hitting a 403 Forbidden error on the /api/v2/outbound/campaigns endpoint. The service account has the outbound:campaign:write permission, yet it fails immediately.

In Zendesk, we just used standard list permissions, but Genesys Cloud seems stricter. The error payload says access_denied without further details.

Is there a specific role binding required for the Architect API user to push these lists? We are in the Paris timezone and using the latest SDK.