Personal Connection API 403 when triggering outbound call via custom provider

Stumbled on a weird bug today with the Personal Connection API when trying to trigger an outbound call. My Pulumi custom provider uses the standard OAuth2 token, but the POST to /api/v2/outbound/campaigns/{id}/runs returns a 403 Forbidden.

The token works fine for /api/v2/users/me. Is there a specific scope I’m missing for outbound execution? The payload is just {“campaignId”: “123”}. Why would auth pass for user read but fail here?