It should also be in the body as described by the docs, not the header, which is why you’re getting a bad request response.