App Step Forbidden error message – updating permissions group SP Designer 2013

When I try to run a Designer 2013 workflow with an App Step, I get the following results from my log:

7/25/2019 4:20 PM HRO ID: i:0#.f|membership|bob@bob.gov 7/25/2019 4:20 PM {“__metadata”:{“type”:”SP.User”},”LoginName”:”i:0#.f|membership|bob@bob.gov”} 7/25/2019 4:20 PM ***User Add Response Code: Forbidden

I have configured my site to allow App Steps – I can create them in my Designer workflows and publish them successfully. I know the URL I’m passing the REST call is correct because if I paste the URL directly into my browser, I get a successful result showing me the actual members of the permissions group I’m trying to update.

What should I be looking at in configurations to remedy this?