Does anyone know what API endpoint and permission are needed to pull work email info from a user?

Summary:

We want to know if it is possible to update an existing work email for a worker via API with an unattended script. If it is possible, we need to know which API endpoint we need to use and how to grant the service account / OAuth app the correct permissions/scopes.

So far, we have tried the following API Endpoints and received a 403 error (forbidden, indicating permissions issue):
POST /hcmRestApi/resources/11.13.18.05/workers/{workersUniqID}/child/emails [headers: {upsert-mode:true}]
PATCH /hcmRestApi/resources/11.13.18.05/workers/{workersUniqID}/child/emails/{EmailAddressId}

Version (include the version you are using, if applicable):

26C

Code Snippet (add any code snippets that support your topic, if applicable):