Update: The 403 error has been fixed and is in 2022-03-03 release candidate. Here are some more findings, using OAuth 2 for authentication.


Postman, Google Developer and SoapUI can all fetch data.

Google Developer can patch or post records with the set_field parameters either in the URL or the body, using any content type you choose.

SoapUI can patch or post records with the set_field parameters in the URL. If these are in the body, they only work if the content type is set to application/x-www-form-urlencoded.

Postman can only patch or post records when the set_field parameters are in the URL. I have not been able to make these work from the body, regardless of which option is chosen e.g. x-www-form-urlencoded, raw, or binary from file. Maybe someone who knows more about Postman will be able to find out why.