Each Profile has a primary key (
PK field). It needs to be supplied with all API calls that make modifications to a profile.
If you have a business account (ignore this if you do not), you can "impersonate" an admin of a child sub-organization, by supplying
X-Force-Org-Id: org_id_goes_hereHTTP header along with all API calls within the Profiles scope. This will allow you to view, create and modify Profiles within the target sub-organization using the API token of the parent (main) Organization.