I’ve enabled data API on a “debug” data type and given privacy rules full access, but that’s not updating either, despite the response still being valid.
Create update and delete in privacy rules are related to Data API not to Backend workflow API. Actually, by doing the ignore privacy rules already give all permissions on thing. I don’t know what your flow is doing exactly so it’s hard to tell you a specific solution. You may consider using api key, user auth or another option to secure things.