What permissions are required to update a WAF rule via the API?

{
  "success": false,
  "errors": [
    {
      "code": 10000,
      "message": "PATCH method not allowed for the api_token authentication scheme"
    }
  ]
}