Unauthorized operation error calling /api/update-user via curl or Python

Hi y'all. I'm struggling with using /api/update-user.

I'm programatically doing this in python, but here is the equivalent curl that fails in the same way:

curl http://localhost:8000/api/update-user?id=newsfeed/beardedtek \
-H 'accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Bearer: my_ver_long_token' \
-d '{
"id": "string",
"owner": "newsfeed",
"displayName": "beardedtek",
"phone": "5555551234",
"address: [
           "My Place",
           "My Town"
          ]
}'

I'm getting back:

{
  "status": "error",
  "msg": "Unauthorized operation",
  "data": null,
  "data2": null
}

see: https://casdoor.org/docs/basic/public-api#how-to-authenticate-with-casdoor-public-api