What's the correct way to add relations via API?

I tried:
POST /api/v3/work_packages/10472/relations with body:

{"target": {"href": "/api/v3/work_packages/10475"}}

but always get "You are not authorized to access this resource.":

{
    "_type": "Error",
    "errorIdentifier": "urn:openproject-org:api:v3:errors:MissingPermission",
    "message": "You are not authorized to access this resource."
}

Using API Key of Admin User, adding relations using the same user via Web UI works.