I replied in the webCore forum but for anyone else looking. I think the issue is the format of the header. For another API I use, the curly brackets need to be sent as text however webCore uses them to define expressions. To send as text, escape them with \
Also not sure you need the curl header portion, only authorization and token
Example from another API that I use: \{ "TOKEN_AUTH" : "{authtoken}" \}
Also, as I noted in the other forum, you should block out your auth token in the third screenshot above.