Azure DevOps KeyVault Linked Variable group "Value cannot be null. Parameter name: variableGroupParameters" - how do i fix this?

Question

I have a need to automate the creation of KeyVault linked variable groups in ADO as part of a pipeline task. I can actually create the var groups after a bit of experimenting. However, using the az devops invoke method one is unable to specify the Azure Subscription and this has to be done manually, after the event - however when I do this in the web interface and attempt to save I get the error:

Value cannot be null. Parameter name: variableGroupParameters

This means any subsequent editing of the created KeyVault linked var group is pointless as it is unable to save it.

The JSON I am submitting is as follows:

  {
    "authorized": true,
    "description": "$description",
    "name": "$name",
    "type": "AzureKeyVault",
    "variableGroupProjectReferences": [{
        "projectReference": {
            "id": "$adoProjectID",
            "name": "$ProjectName"
        },
        "name": "$name",
        "description": "$description"
    }],
    "providerData": {
        "serviceEndpointId": "$AdoSvcConnId",
        "vault": "$KeyVaultNM"
    },

    "variables": {
        "SOMETHINGSECRET": {
            "isSecret": true,
            "value": null,
            "enabled": true,
            "contentType": ""
        },
        "variables": {
            "ANOTHERSECRET": {
                "isSecret": true,
                "value": null,
                "enabled": true,
                "contentType": ""
            }
        }
    }
}

Where the $tokenized values are replaced during the powershell/az cli task

The command (which works but results in broken var group that can't be edited or saved) is as follows:

az devops invoke --http-method post --area distributedtask --resource variablegroups --in-file "vgroup_azure_rm.json" --encoding utf-8 --route-parameters project=$ProjectName --api-version 5.0-preview

Anyone have an insight in how to fix this please?