Data Masking: 400 Bad Request on /api/v2/architect/flows

Can anyone explain why the data_masking property in actions triggers a 400 Bad Request with code invalid_request? We are migrating from Zendesk’s field-level privacy settings to Genesys Cloud Architect, and the documentation implies simple boolean toggles, but the API rejects the payload. The error message cites Invalid action type for masking rule, which seems contradictory since we are using standard set-variable actions.