CXone Personal Connection API 403 Forbidden when triggering outbound call from python CLI

Does anyone know how to properly scope the oauth tokens for the cxone personal connection api? i am building a custom cli tool using python typer to manage agent interactions and i am hitting a wall with the outbound call trigger endpoint.

my cli works fine for fetching user details via the /api/v2/users endpoint but when i try to post to /api/v2/communications/outbound/calls with the personal connection payload it throws a 403 forbidden error. i have verified that the client credentials have the right scopes in the cxone developer portal and i am using the standard oauth2 client credentials flow to get the token.

here is the python code snippet i am using to make the request:

import requests

def trigger_outbound_call(access_token, to_number):
 url = "https://platform.devtest.nice.incontact.com/api/v2/communications/outbound/calls"
 headers = {
 "Authorization": f"Bearer {access_token}",
 "Content-Type": "application/json"
 }
 payload = {
 "to": [{
 "address": to_number,
 "type": "phone"
 }],
 "personalConnection": {
 "id": "pc_12345678-1234-1234-1234-123456789012"
 },
 "from": {
 "address": "+1234567890",
 "type": "phone"
 }
 }
 response = requests.post(url, json=payload, headers=headers)
 print(response.status_code)
 print(response.text)

the error response i get is:

{
 "message": "Forbidden",
 "errors": [
 "Access to the requested resource is denied"
 ]
}

i have checked the api documentation and it says i need the communications:write scope but i already added that. is there a specific permission i need to enable on the personal connection object itself or is this a known issue with the devtest environment? also my cli runs from my local machine in lagos so maybe there is some geo-restriction but that seems unlikely for api calls. any help would be appreciated as i am stuck on this for two days now.