Are you able to reset other sources (i.e. non-authoritative sources) through either method currently?
The API call does indeed look like a permission issue - if you are using the same PAT for the VSC plugin this could explain it. Make sure you have sp:scopes:all - and try with another non-authoritative source if possible.
