When trying to whitelist players, the server returns back a 403: Forbidden error. This behaviour can also be observed if we send a cURL request to the API directly. This is running with a standard server jar downloaded from https://minecraft.net/download/server and ran according to the instructions there.

Notably, this problem does not occur if the player has previously joined the server.

See the images attached for further details.