WFM Analytics API 403 on Custom Report Export

Stuck on a 403 Forbidden when calling GET /api/v2/analytics/reporting/query via Python SDK v1.12.0. The user has reports:view scope but lacks reports:export. The docs here suggest scope inheritance is automatic for admins, but it is failing. Is there a hidden permission block for external API calls?