POST /groups/:id/deploy_tokens requires expires_at

the documentation here: https://docs.gitlab.com/ce/api/deploy_tokens.html#create-a-group-deploy-token states that only name and scopes parameters are required, but creating a token using gitlab.com (which was running 12.9.0-pre 4b942459) Deploy Token API requires the four parameters:

curl --request POST --header "PRIVATE-TOKEN: TOKEN" --header "Content-Type: application/json" --data '{"name": "My deploy token", "scopes": ["read_repository"]}' "https://gitlab.com/api/v4/projects/PROJECT_ID/deploy_tokens/"
{"error":"expires_at is missing, username is missing"}

curl --request POST --header "PRIVATE-TOKEN: TOKEN" --header "Content-Type: application/json" --data '{"name": "My deploy token", "scopes": ["read_repository"], "expires_at": "2021-01-01"}' "https://gitlab.com/api/v4/projects/PROJECT_ID/deploy_tokens/"
{"error":"username is missing"}

Creating a token via the UI only requires the two parameters.

Am I doing something wrong ?