WFM Capacity API 403 on Multi-Tenant AppFoundry

Trying to make sense of why the Capacity API returns a 403 Forbidden for specific orgs in our multi-tenant AppFoundry setup. The OAuth token includes wfm:capacity:read. Other endpoints work fine. Is there a hidden scope requirement?