Genesys Cloud Recording API start/stop 403 Forbidden

Trying to programmatically control call recordings via the API. The UI lets us start/stop, but the endpoint for starting/stopping snippet recording keeps throwing a 403 Forbidden. We’ve checked the OAuth token and it has the recording:interaction scope. Here’s the curl request we’re using:

curl -X POST "https://{org}.mygen.com/api/v2/conversations/calls/{conversationId}/participants/{participantId}/snippet/record" \
 -H "Authorization: Bearer {token}" \
 -H "Content-Type: application/json"

The error response is just {"errors":[{"message":"Forbidden"}]}. No more details. Is there a specific permission we’re missing? Or is this API endpoint deprecated? We need to trigger recordings based on IVR logic, not just rely on the global setting. Any ideas?