Ah turns out I was wrong but never went back to the post to revise.
I always call the endpoint with a me auth as it is