This turned out to be unrelated to privacy settings. Fixing Auth settings in Postman resolved. :man_facepalming: