PATCH /api/v2/users compliance attestation hitting 429 on bulk runs

Running a Node script against Genesys Cloud v2 to push SOC2 consent flags across two thousand agents. The /api/v2/users endpoint throws 429 Too Many Requests after four hundred PATCH calls, despite a 2.5 second delay between batches. Console shows the OAuth token is valid. Rate limit headers return X-RateLimit-Reset: 120, which doesn’t match the docs. Does the compliance bulk endpoint require a different scope than standard provisioning? Script is just doing jack all past that mark.
await axios.patch(url, { consent: true }, { headers: auth })
Throttle behavior seems inconsistent with published limits.