Thanks @..., was able to confirm that it doesn't appear to be an auth issue, as changing the credentials caused a different error. I'm not familiar with JSON/Liquid so not sure what would be a basic request to run, but when I left the JSON input blank it errored out with "400 Bad Request" ("both ticket IDs and arguments required").

I created a trigger to send the liquid script via email and it (I think correctly) delivered this for a ticket which did not have an attachment:

{"ticket":{"additional_tags":["attachments_no"]}}

What I don't know is how that translates into adding a tag to the ticket.