I can access any other APIs under my hosted Azure Devops Server instance except the tokens/pats one that allows me to programmatically create a PAT.

For example, this works fine:

Invoke-WebRequest -Method Get -UseDefaultCredentials -ContentType Application/JSON `
-Uri "$myAzDOServer/_apis/projects?api-version=7.0-preview.1"

Gives me a nice pile of json about my projects.

This does not:

Invoke-WebRequest -Method Post -UseDefaultCredentials -ContentType Application/JSON `
-Uri "$myAzDOServer/_apis/tokens/pats?api-version=7.0-preview.1" `
-Body ([PSCustomObject]@{
  displayName = "test_token"
  scope = "app_token"
  validTo = (Get-Date (Get-Date).AddDays(1) -Format "o") 
  allOrgs = $false
} | ConvertTo-Json)

It always returns a 403. "The requested operation is not allowed."

Googling around there’s some story of needing to use a different token with this particular API, but the exact way to do that with a hosted AzDO Server instance and a hosted AD is very unclear.

Any help would be appreciated.