…turns out there was a bug which caused it to only work when the Application Key has access to “all vaults”.

The developer replied and provided a workaround the same day… so that’s great support!