Webex API: promote a user to room moderator using service app

[clue]

Hello,

I'm trying to promote a user in a webex room to moderator via the /memberships/{membershipId} api endpoint using a service app, but I always recieve
403 : {"message":"Failed to update membership.","errors":[{"description":"Failed to update membership."}],"trackingId":"ROUTERGW_14404132-6b46-4341-9020-b66bb4bc686b"}

The first tests with using the temporary access token from developer.webex.com where successful, so I added the scopes

spark:memberships_read
spark-compliance:memberships_read
spark:kms
spark-compliance:memberships_write
spark:people_read
spark:rooms_read
spark:memberships_write
spark:rooms_write
spark-compliance:rooms_write
spark-compliance:rooms_read

to the service app, created a new token pair and tried with the new access token via postman.

Trying to promote a user to moderator in a room always ends with the given 403 error, but demoting a moderator to normal user always works without problems (both while using the service apps access token). Using the temp. developer access token, I still can promote users without problems.
The developing user is full admin and compliance officer for simplicity reasons. This user also authorised the service app in control hub.

Is there a scope missing? Or what could be wrong in my appoach?

Thanks for helping.

[Jeff Marshall]

Having the spark-compliance:memberships_write scope should allow a Service App to be able to add or update users memberships in a space owned by the org. However, if the space is part of a team then the user will need to be added to the team general space first before they'll be able to be a moderator of the team sub-space. They don't need to be a moderator of the team, just need to be a member of the team. You can get the roomId for the team's general space and use the same /memberships API to add them. Also note that Service Apps are their own machine accounts and don't act on behalf of a real user like an Integration does.