What Graph API permissions are required to provision an external user to an app?

Question

I want to invite an external user to an app, and want to set up the appropriate permissions in order to automate the process. Following the documentation this is what I have so far. I'm just wondering if there's a piece of the puzzle missing. By counterpoint, if I hand jam my way through the process in portal then it's no big deal. So I get the sense that there's either some piece of documentation that I've missed or there's a small but important gap in what's documented versus what's actually required in order to make this an automated process.