TFS REST upload attachment permission problems

I'm implementing TFS to our service. I'm using OAuth2, and it is working like a charm. I'm requesting permission scopes "vso.work_write vso.project" but somehow I'm not able to upload attachments. I'm getting 403 Forbidden from the server. As MS documentation is full of holes on this subject can maybe somebody point out if my scope permission are OK or not? Which should I add to my auth?

It is probably not important but I'm using Nginx/Python, and making requests with the standard Request lib.

Code example:

def __auth(self):
        return "Bearer " + self.token

def __makeUrl(self, resource, project=None):
        if project:
            return (self.baseurl % (self.domain, "%s/" % project)) + resource
        else:
            return (self.baseurl % (self.domain, "")) + resource

code that will make request:

headers={'Accept': 'application/json',
                     'Authorization': self.__auth()}

url = self.__makeUrl(("/wit/attachments?fileName=%s&api-version=1.0" % fileName), self.project)
response = self.client.post(url, base64.b64encode(filecontent), headers=headers)

Heads up for the code. I'm almost sure that generate URL is OK as I'm using the same logic for other requests (e.q. project and project type read)

I could really use a push to the right direction.