"POST /boards/{boardId}/undo_delete" API endpoint unexpected behavior

Hello, I'm trying to use the Deck API but have found an obstacle with the "undo_delete" endpoint. Which may or may not contain a problem in between the chair and the monitor.

I create a board, delete it and try to undo its deletion all with the same user.

Steps to reproduce:

curl -X POST 'https://username:password@nextcloud.local/index.php/apps/deck/api/v1.0/boards' \
  -H 'Accept: application/json' \
  -H "Content-Type: application/json" \
  -H 'OCS-APIRequest: true' \
   --data-raw '{"title":"A board","color":"FF00FF"}'

This will create the board and successfully return its data.

curl -X DELETE 'https://username:password@nextcloud.local/index.php/apps/deck/api/v1.0/boards/31' \
  -H 'Accept: application/json' \
  -H "Content-Type: application/json" \
  -H 'OCS-APIRequest: true'

Deletes the board as expected given the docs.

Now to undo that we would use:

curl -X POST 'https://username:password@nextcloud.local/index.php/apps/deck/api/v1.0/boards/31/undo_delete' \
  -H 'Accept: application/json' \
  -H "Content-Type: application/json" \
  -H 'OCS-APIRequest: true'

I would be expecting this to undo the board deletion but the reply I get from the server is the HTTP code 403.
(curl also gives curl: (8) Weird server reply)

The board has the following permissions:

"permissions": {
  "PERMISSION_READ": true,
  "PERMISSION_EDIT": true,
  "PERMISSION_MANAGE": true,
  "PERMISSION_SHARE": true
},

Am I approaching this wrong?
Is the user that created the board unable to undo its deletion?

Thanks

The reported entry point is POST /boards/{boardId}/undo_delete; first reproduce the create, delete, and undo sequence with the provided curl requests and inspect the endpoint's response and permission behavior. Done means a user who creates and deletes a board can undo that deletion successfully with a valid HTTP response.