https://[host]/pkmscdsso?https://[API_HOST]:[PORT]/[WEBSEAL_JUNCTION]/[TEST]/v2/[TEST]/token

I'm trying to retrieve a Token using a Connect REST integration in Pega 7.3.1.

The Token API is protected by a Webseal front and the design is for us to use pass CDSSO details to authenticate (end users already authenticate at Webseal when logging into the Pega app).

End Users will need to generate a Token when they are already authenticated at Pega layer (the token is used to fetch customer preferences but only required when a notification needs to be generated)

Hardcoding Basic Auth to prove I can reach the API works as expected and I can generate the Token.

However Auth needs to be from CDSSO. Obviously because of the question mark in the URL, the API URL is treated as Query Params. I've tried to use the Hex equivalent for the question mark as %3F but still no luck, keep getting 401 Unauthorized. Anyone know how I should be calling this to authenticate correctly?