Personal Connection API outbound call initiation failing with 403

Is it possible to trigger a CXone outbound call using the Personal Connection API for an agent who is currently on a different conversation?

I have been building a custom reporting dashboard that needs to simulate agent-initiated outbound calls for testing data flow into our Power BI reports. The goal is to use the /api/v2/outbound/calls endpoint to start a Personal Connection call programmatically. I am authenticating via a standard OAuth2 client credentials flow with the manage_outbound scope.

Here is the JSON payload I am sending in the POST request body:

{
 "to": "+15550199",
 "from": "+15550100",
 "type": "personalConnection",
 "agentId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

The request consistently returns a 403 Forbidden error. The error response body is minimal:

{
 "message": "Forbidden",
 "code": "unauthorized"
}

I have verified that the agentId belongs to a valid user in the organization and that this user has the call_center role with the make_outbound_calls permission enabled in the UI. The user is currently logged into the Genesys Cloud desktop client and is in the Available state, but not actively engaged in another call at the moment of the API request.

According to the documentation:

“Personal Connection calls are initiated by agents and are tied to the agent’s specific user context. The API requires the caller to have sufficient permissions to act on behalf of the agent, or to be the agent themselves using a user token.”

I initially tried using a user access token generated via the authorization code flow for the specific agent, but I still receive the 403. I suspect the issue might be related to the agent’s current presence state or a hidden permission flag in the security profile that isn’t exposed in the standard role editor. Has anyone successfully scripted this flow? I need to understand if the Personal Connection type requires the agent to be in a specific ‘Ready’ state or if there is a separate API call required to ‘authorize’ the outbound action before the call can be placed.

Have you tried switching from client credentials to resource owner password credentials? The outbound API requires an agent token, not an app token. Ensure your Electron app stores the agent’s access_token in the main process and passes it via IPC to the renderer for the POST /api/v2/outbound/calls request.

The root cause here is the client credentials grant lacking user context.

Cause: The Personal Connection API requires an authenticated agent session, not an application token.

Solution: Switch to the Resource Owner Password Credentials flow. The example below demonstrates the correct token acquisition for agent-specific actions.

curl -X POST https://api.mypurecloud.com/oauth/token \
 -d "grant_type=password&username=[email protected]&password=secret"

Make sure you inject the agent’s access_token into the platformClient constructor, as the Java SDK documentation states “personal connections require user-scoped authentication,” which explains the 403. The client credentials flow lacks the necessary user context for POST /api/v2/outbound/calls.