Through more experimentation, I found the culprit-
This does not work:
curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonDataEncoded);
This does work:
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
So it was the processing of the data in $data through curl which was causing the permission problem.