Doh, of course! Not all GETs require Authorization!
That’s such a nice pointer, I will look into that. Thanks!
Things that I already know by reverse engineering:
api-keyrather thanapi_key- The
PUTrequest requires"content-type": "application/x-www-form-urlencoded" - The data is not in JSON (it’s encoded, although I don’t seem to find the right encoding)