According to the docs, they say the variables object requires string values, not raw types, so the API parser fails on the unquoted phone number. Try this structure:
I think the client credentials grant often lacks sufficient scope for flow execution unless explicitly granted. The documentation states, “The access token must include the flow:execute scope.” Ensure your token request includes this.