WFM Schedule Publish API 403 Forbidden with Service Account

HTTP 403 Forbidden
{
 "code": "forbidden",
 "message": "The provided credentials do not have permission to perform this action."
}

Trying to automate weekly schedule publishing via the PUT /api/v2/wfm/schedules/{scheduleId}/publish endpoint. My service account has the wfm:schedule:publish capability enabled, yet the call fails.

Payload:

{
 "publishDate": "2023-10-27T08:00:00.000Z"
}

Any ideas on hidden permission requirements?