Nice, looks like I found it
-H "OCS-APIRequest: true" was missing.
curl -u "myuser:mypassword" -H "OCS-APIRequest: true" -X POST https://nextcloud/ocs/v1.php/apps/files_sharing/api/v1/shares -d path="globalshare/0002/pic.jpg" -d shareType=3 -d permissions=1 -d expireDate="2017-07-20"