I was, but I had generated an API key for all users, and this morning when I tried generating one tied to my admin username things began working. 
Maybe it’s worth noting that in the docs somewhere - or in the post about reverse-engineering undocumented API endpoints? I thought for sure I was doing something wrong by the end of yesterday, but I couldn’t see any mention in the docs of different permission levels for certain API routes versus others.
Thanks for the help - I appreciate it!