Hi there,
Firstly if you are getting {“errors”:“The api_client does not have the required permission(s).”} when you call that from the browser that has nothing to do with your app or private app permissions but the user permissions you are logged in with on the shop. This happens to me when I am logged into a client shop but not when logged into a dev shop as owner.
Secondly, the expected hash to be an array is because you have an error in your json document when posting to the fulfillment endpoint. I would double check that the json that your code is producing is correct. .
Cheers
Gary