Very probably a red herring, but FWIW the endpoint I hit doesn't include the "command" part: "https://owner-api.teslamotors.com/api/1/vehicles/\(carID)/wake_up". I imagine they are synonyms but just in case.
Holy cow I'm an idiot; thank you!
That is so weird that my mistake is an actual endpoint...that seems to do nothing.