I have managed to do something like this from a mashup. Does the user used in your case have the right to do this? If you try with a user that is RootAdmin does it still fail?
I am light on the QES API, but after step 3 are you calling a DoSave operation (https://help.qlik.com/en-US/sense-developer/June2018/APIs/EngineAPI/services-Doc-DoSave.html)?
This is the websocket capture of a similar operation in the Hub: