Permission denied creating webhook

I’m trying to register a webhook and getting a Permission Denied error. The bearer token is correct and the controller id is correct – other http requests work. Any suggestions?

curl --request POST \
  --url https://cloud-rest.rach.io/webhook/createWebhook \
  --header 'Accept: application/json' \
  --header 'Authorization: Bearer xxx' \
  --header 'Content-Type: application/json' \
  --data '{
    "resource_id": {
      "irrigation_controller_id": "xxx"
    },
    "url": "https://mywebhook",
    "event_types": [
      "SCHEDULE_COMPLETED_EVENT"
    ]
  }'

Error 403

{"message":"An error occurred: PERMISSION_DENIED: The authenticated user is not authorized to perform this action"}