POST /api/v2/flows/executions: 403 Forbidden on flow launch

Trying to trigger an Architect flow from an external node service. Getting a 403 Forbidden on POST /api/v2/flows/executions even though the service account has the flow:read and flow:execute permissions. Here’s the payload I’m sending:

{
 "flowId": "12345678-1234-1234-1234-123456789012"
}

The token is valid and works for other endpoints. Any idea what’s blocking this specific call?