Migration to V8: kibana reporting-user depreciated

basic license on version 7.17...

I spent hours on this yesterday and failed to figure out how to use "kibana privileges" to allow reporting for users.

the screenshot in the documentation do not match what I see.

I restarted kibana with xpack.reporting.roles.enabled: false
Verified that I was no longer able to download a csv file from discover.
roles > create > kibana > add kibana privilige

this appear to only allow assigning privs to workspace which is not what I want. I need to be able to create a role that can be applied to users. Also there is no way I can see of adding a reporting function. Screen shots in docs show an expansion > for discover etc

Do I have to do this via the API?

edit: just found Configure Kibana reporting | Elastic Docs

which suggests that, for basic license configuring in kibana you have to select "ALL", which means that you are also granting write access : (

I tried to create a user role via the api :

curl -u elastic --noproxy \* -X  PUT https://secmgrprd04.its.auckland.ac.nz:5601/api/security/role/csv-download -d '
{
  "elasticsearch": {
    "cluster" : [ ],
    "indices" : [ ]
  },
  "kibana": [
    {
      "base": [],
      "feature": {
        "visualize_v2": ["all"],
        "dashboard_v2": ["read", "url_create"]
      },
      "spaces": ["marketing"]
    }
  ]
}'

copied from the docs and got this response:
{"statusCode":400,"error":"Bad Request","message":"Request must contain a kbn-xsrf header."}

How am I supposed to make such api requests?