I have been speaking with my SailPoint expert services representative and it seems like the only solution to automate “Apply Changes” is by using the /beta/identities/process endpoint (start-identity-processing | SailPoint Developer Community).
The actual endpoint that “Apply Changes” calls is /ears/roles/roles/refresh?optimized=true but it is impossible to call this API using a PAT. The only way to call this API is with the session token retrieved from the https://mytenant.identitynow.com/ui/session url.
My feedback to SailPoint: create a lighter weight refresh roles API that I can call to apply the role changes without having to call the more resource intensive /beta/start-identity-processing/.