Reporting API 403 on custom metric aggregation

Can anyone clarify the strict schema requirements for custom data actions in Genesys Cloud?

GET /api/v2/analytics/reporting/users/summary returns 403 Forbidden. Using v2.1 SDK. APAC edge. Standard metrics work fine.

Config:

metrics:
 - id: custom_csat_avg
 type: avg
 filter: satisfaction > 0

Error response body is empty. Permissions are correct for standard metrics.