Scoping OAuth client to specific divisions for multi-tenant access

Quick question about scoping an OAuth client to specific divisions for multi-tenant BPO access. I’m using the Genesys Cloud Platform SDK in Node.js to create the client with apiClients.auth.createAuthClient, but setting divisions in the payload returns a 400 Bad Request with "reason":"Invalid divisions format".

{
 "name": "BPO Client",
 "client_type": "confidential",
 "divisions": ["divisionId-123"]
}

Is the API endpoint for updating client scopes different from creation, or am I missing a required header?