DELETE recording endpoint returning "No permission"

I’m trying to delete a meeting recording. I’m using this endpoint:

(the above are real meeting IDs and recording file IDs).

I’m using a server-to-server OAuth key; the token is fine (I can GET anything I want). It has ‘recording:write:admin’, ‘recording:master’, ‘recording:read:admin’.

The request has a valid bearer token; I keep getting an HTTP 400 with this JSON:
“code”: 200,
“message”: “No permission.”

What am I missing ?