WFM Schedule Publish API 403 Forbidden with Service Account

HTTP 403 Forbidden
{
“code”: “forbidden”,
“message”: “The provided credentials do not have permission to perform this action.”
}

Trying to automate weekly schedule publishing via the WFM schedule publishing endpoint. My service account has the wfm:schedule:publish capability enabled, yet the call fails.

Payload:

{
 "publishDate": "2023-10-27T08:00:00.000Z"
}

Any ideas on hidden permission requirements?