I am seeing similar behavior too for read API (for example get user by email api), master token and _uid are ignored when sending request. The document states that master token can be used, however it doesn't seem to be the case for all APIs.
I am trying to call api/v3/categories/111/privileges/groups:posts:upvote to set privileges for a group. It's a PUT API, and it seems to accept array of privileges on server side. I tried multiple ways to pass array in the URL and all attempts failed.
for example /api/v3/categories/111/privileges/privilege=groups:posts:upvote&privilege=groups:posts:delete
Any idea how to pass array of privileges to PUT API?