Getting additional permission on existing installation for public app

[capabl]

We have our app installed on many of our client's stores on shopify. Now, after a latest deprecation by shopify we need to get few more permission from our app's existing installations.

I read at shopify's doc that we don't need to ask our customers to explicitly grant us the additional permissions.

and for this purpose, we need to perform a post call for shopify's admin REST API.

but when I am trying to make a post call, I am getting a 302 Not Found error.

I am posting how I am trying to perform that below:

1. using the creds of one our dev stores.

2. these are param values in above posted post url

3. following header are being sent

4. here is the body, we only require read permission for this

I am getting an error response for this post call:

Question 1: Is my understanding correct?

Question 2: What is wrong in the process I am following?