in the end I wasn't actually replicating my curl request properly