Hitting the exact same thing — confirmed this isn't a permissions/scope issue on our end
either (Admin-role key, same 403 with "Allowed operations are: GET_COLLECTION,
GET_INSTANCE, UPDATE"). Everything else in our app-provisioning pipeline is fully
API-key-driven (Bundle IDs, capabilities including updates via PATCH, certificates,
profiles) — app creation is the one remaining step that forces us back to an interactive,
session-based Apple ID login, since the only working alternative we've found (fastlane's
produce tool) goes through a private, non-API-key-compatible endpoint internally.
Filed as FB24429185 if anyone wants to reference it or add their own report against the
same gap.
