Genesys Cloud Recording API start/stop 403 Forbidden

Trying to programmatically control call recordings via the API. The UI lets us start/stop, but the /api/v2/recordings/interactions endpoint keeps throwing a 403 Forbidden. We’ve checked the OAuth token and it has the recording:interaction scope. Here’s the curl request we’re using:

curl -X POST "https://{org}.mygen.com/api/v2/recordings/interactions/start" \
 -H "Authorization: Bearer {token}" \
 -H "Content-Type: application/json" \
 -d '{"interactionId": "12345"}'

The error response is just {"errors":[{"message":"Forbidden"}]}. No more details. Is there a specific permission we’re missing? Or is this API endpoint deprecated? We need to trigger recordings based on IVR logic, not just rely on the global setting. Any ideas?