Update for the benefit of anyone else with the issue.
I raised a ticket with Graph API support and they flicked a switch which allowed it to work. So it appears that it won't work by default, possibly to prevent abuse.