user00287

Thanks Grant for the clarification.

Thanks JaeW for offering your thoughts. Have tested with Postman - works fine. Tried to Postman generated javascript as a sense check - still get the 403. After some digging, I think that because the user-agent is a browser, the end-point is expecting the client side authentication token.

100% this. We have orphaned credential accounts (people no longer in a role, at the company) that no one can access or manage. Is there something I'm missing? 

Same boat here. Would love to programatically manage card - even just access the metadata (id, name, datasource)