Outbound Campaign API 403 Forbidden when mapping Zendesk Ticket Fields to Contact Attributes

Has anyone figured out why the Genesys Cloud Outbound API returns a 403 Forbidden error when attempting to update contact attributes via the PUT /api/v2/outbound/contacts/{contactId} endpoint during our Zendesk migration?

We are migrating our outbound dialing operations from Zendesk Sell to Genesys Cloud. In Zendesk, we relied heavily on custom ticket fields to store lead scores and last contact dates. The goal is to map these directly to Genesys Contact Attributes so that our Predictive Dialing campaigns can use them for segmentation.

The environment details are as follows:

  • Genesys Cloud Region: eu-west-1
  • SDK: Python 3.8.1
  • User Role: Outbound Admin
  • Authentication: Service Account with outbound:campaign:edit and outbound:contact:edit permissions granted.

Here are the steps to reproduce the issue:

  1. Create a new contact in Genesys Cloud Outbound via the API, ensuring the external_id matches the Zendesk Ticket ID.
  2. Attempt to update the contact record by adding a new attribute named zdesk_lead_score with a value of 85.
  3. The initial creation succeeds, but the subsequent update request fails with a 403 status code.
  4. The error message returned is: "Forbidden: You do not have permission to update contact attributes for this campaign."

This is confusing because the same service account can successfully update campaign settings. In Zendesk, updating custom fields was straightforward and did not require granular permission checks per field name. We assumed that having outbound:contact:edit would allow full attribute manipulation.

Is there a specific permission scope missing, or is there a restriction on attribute naming conventions (e.g., using underscores) that we are overlooking? We need this mapping to work to maintain our lead scoring logic during the cutover phase. Any insights on the correct API payload structure or permission requirements would be greatly appreciated.