PATCH /conversations/participants/{id} returns 400 on attribute update

We’ve got a Python script running on a side service that needs to push internal risk scores into the conversation context. The idea is simple: grab the participant ID from the webhook event, then fire a PATCH request to update the custom attributes. The docs say you can modify attributes on an active participant, but the API keeps rejecting the payload with a 400 Bad Request. No helpful error message, just “Validation failed”. I’ve checked the token scope, it’s got conversations:write, and the participant ID is definitely correct since I can GET the details without issue. Here’s the request I’m sending:

import requests

headers = {
 'Authorization': f'Bearer {token}',
 'Content-Type': 'application/json'
}

payload = {
 "attributes": {
 "risk_score": "high",
 "vip_flag": True
 }
}

url = f'https://api.mypurecloud.com/api/v2/conversations/participants/{participant_id}'
resp = requests.patch(url, json=payload, headers=headers)
print(resp.status_code, resp.text)

The response is always 400. I’ve tried removing the attributes wrapper and just sending the key-value pairs directly, same result. I’ve also tried sending the full participant object retrieved from the GET call with just the attributes field mutated, which feels like overkill but worth a shot. Still 400. Is there a specific format for the attributes map that isn’t documented? Or is this endpoint strictly for updates and not data injection? The standard attributes work fine when I set them on queue creation, but mid-flow updates seem locked down. We’re on the latest Python SDK too, version 145.0.0. Nothing in the release notes mentions a change here. Just wondering if anyone has successfully patched attributes on a live participant without hitting a wall. The error trace is empty.