WebSocket subscription returns 403 on Genesys Cloud /api/v2/

Trying to set up a persistent connection for real-time adherence tracking. Using the standard Python SDK method notifications_api.subscribe_to_notifications with a valid OAuth token.

The connection drops immediately with a 403 Forbidden error. The token works fine for standard REST calls to /api/v2/users. Is there a specific scope required for WebSocket subscriptions that I am missing?