EventBridge rule triggers but Genesys target returns 403

Problem
The EventBridge rule fires, but the Genesys Cloud target returns a 403 Forbidden. I’ve verified the API key in the target configuration. Here’s the target JSON:

{
 "Id": "genesys-target",
 "Arn": "arn:aws:events:::target/genesys",
 "InputPath": "$.detail"
}

The 403 error suggests an auth issue, but the credentials look correct. What’s missing?