The api call update-workgroup-members-v-1 | SailPoint Developer Community lists
as required scope. idn:workgroup:write doesnt even exist as a scope
Second issue is that this call fails if the PAT doesnt have both idn:workgroup:manage and idn:identity:read
The same goes for api call delete-workgroup-members-v-1 | SailPoint Developer Community