In Keycloak 21.1, I was able to send the execute-actions-email request for the master realm users using the following endpoint:

curl --location --request PUT 'http://<your_ip>:<your_port>/auth/admin/realms/master/users/<user_id>/execute-actions-email' 
--header 'Authorization: Bearer <my_token>' 
--header 'Content-Type: application/json' 
--data '["UPDATE_PASSWORD"]'

And you’ll get a 204 response (the server successfully processed the request, but is not returning any content) which is fine.

The problem is, I was not able to do this for non-master realms. Despite having assigned the necessary roles to my client and user, I get a 400 Bad Request response.

{
    "errorMessage": "Client is not enabled"
}

• I am 100% sure I have enabled both the client and the user.
• The SMTP configuration of the realm works because I can send test emails using the Keycloak admin panel.
• Using a token obtained from the master realm returns the same response in this non-master realm; but works fine in the master realm. I thought master realm tokens can be used to alter other realms (and it is true for other actions).

Do you have any ideas?