POST /api/v2/conversations/calls returns 403 Forbidden with valid OAuth token

Trying to initiate an outbound call on behalf of an agent from our custom desktop app. The app runs as a service account but needs to place calls under the logged-in user’s context.

I’m using the Genesys Cloud Python SDK. Here’s the call:

api_instance = conversations_api.ConversationsApi(api_client)
body = CreateCallOptions(
 to_address=Address(address_number='15551234567'),
 from_address=Address(address_number='15559876543'),
 provider_id='provider-uuid',
 user_id='agent-user-uuid'
)
try:
 api_response = api_instance.post_conversations_calls(body)
 print(api_response)
except ApiException as e:
 print("Exception when calling ConversationsApi->post_conversations_calls: %s\n" % e)

The user_id is definitely valid. The service account has telephony:call:write permissions. The agent has telephony:call permissions.

Still getting:

Exception when calling ConversationsApi->post_conversations_calls: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict(...)
HTTP response body: {"message":"Forbidden","errors":["Access Denied"]}

Checked the permissions again. Double-checked the OAuth token. It’s fresh.

Is there a specific permission I’m missing for placing calls on behalf of another user? Or is this endpoint restricted to certain account types?

Also tried passing on_behalf_of_user_id in the body but that field isn’t in the SDK model. The docs say user_id should work for this.

Any ideas?