Quality Management API 403 Forbidden on Bulk Evaluation Creation via Multi-Tenant AppFoundry Partner App

We are currently debugging a persistent 403 Forbidden error when attempting to create quality evaluations in bulk via the Platform API (/api/v2/quality/evaluations) within our AppFoundry partner application. Our solution is designed to automatically generate evaluation forms based on custom scoring criteria defined in our external database, syncing them to multiple Genesys Cloud organizations through a multi-tenant OAuth flow.

The issue arises specifically when our backend service attempts to POST new evaluation records. While the initial OAuth token acquisition succeeds and we can successfully retrieve user profiles and interaction metadata using the same access token, the Quality Management endpoints reject the requests with a 403 status code. The response body indicates a permissions error, specifically citing that the application lacks the required ‘quality:evaluation:write’ scope, despite our AppFoundry app configuration explicitly requesting this scope during the installation phase.

We have verified the following:

  1. The OAuth token used for the request is valid and not expired.
  2. The installation consent for the partner app includes the ‘quality:evaluation:write’ permission.
  3. The user context associated with the token is an Organization Admin with Quality Manager privileges.
  4. The API version is v2, and the payload structure matches the schema documented in the Genesys Cloud API reference.

Interestingly, manual creation of evaluations via the Genesys Cloud UI by the same admin user works without issue. This suggests the problem may be related to how the application’s delegated permissions are being resolved at the time of the API call, or potentially a limitation in how AppFoundry partner apps handle Quality Management scopes across different org environments.

Has anyone encountered similar permission resolution issues with the Quality Management API in a multi-tenant AppFoundry context? Are there additional configuration steps required beyond the standard OAuth scope definition to enable programmatic evaluation creation?