INSUFFICIENT_PERMISSION while call API accounts:sendOobCode

[cg10]

The curl

curl --location 'https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=[API-Key]&tenantId=[tenant-id]' \
--header 'Content-Type: application/json' \
--data-raw '{
"requestType": "PASSWORD_RESET",
"email": "[email]",
"returnOobLink": true
}'

The API key has the required identity toolkit permission 

but despite of it I am getting error 

{
"error": {
"code": 400,
"message": "INSUFFICIENT_PERMISSION",
"errors": [
{
"message": "INSUFFICIENT_PERMISSION",
"domain": "global",
"reason": "invalid"
}
]
}
}

Please help me know where I am wrong?