API v3 - Can't close tickets

We are able to create tickets that are already in the closed status, but we can't close existing tickets via the API.

Using the below Powershell snippet OR Postman, I can't get the call to succeed:

If i purposely malform the request, I can get a JSON formatted error from the API, but in the correct format, I receive an HTML 401 page.

Powershell snippet to close a ticket:

function Close-Ticket {
    param([Parameter(Mandatory=$true)][Int64]$TicketId, [Parameter(Mandatory=$true)][String]$ClosureComment, [Parameter(Mandatory=$true)][ValidateSet("success", "cancelled")][String]$ClosureCode)

    $uri = "$($ApiBaseUrl)/app/itdesk/api/v3/requests/$($TicketId)"
    $headers = @{
        'Authorization' = 'Zoho-oauthtoken ' + $AccessToken
        'Accept' = 'application/vnd.manageengine.sdp.v3+json'
    }

    $body = "input_data={`"request`": {`"closure_info`": {`"requester_ack_resolution`": true, `"requester_ack_comments`": `"Closed by automation`",`"closure_comments`":`"$($ClosureComment)`", `"closure_code`": {`"name`":`"$($ClosureCode)`"} }}}"
    #$body = [System.Web.HttpUtility]::UrlEncode($body)
    try {
        Write-Host $uri
        Write-Host $body

        $resp = Invoke-WebRequest -Uri $uri -Method Put -Headers $headers -Body $body -ContentType "application/x-www-form-urlencoded; charset=UTF-8"
    } catch {
        Write-Host "EXCEPTION: $_"
        return -1;
    }
    return ($resp.response_status.status_code -eq 2000)

}

Running this with a valid access token and ticket # results in the following response:

HTTP Status 401 – Unauthorizedbody {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}HTTP Status 401 – UnauthorizedType Status ReportMessage UnauthorizedDescription The request has not been applied because it lacks valid authentication credentials for the target resource.ATT

Other calls work as described in the documentation, we can create tickets, add attachments, etc. Updating a ticket by either trying to close it or update a single field results in the same error.

The access token is obtained from a refresh token with the SDPOnDemand.requests.ALL scope. Is there a different scope for being able to update/close requests?