Indeed it is, spring security uses access_token by default, as do the other end points I use.
Thank you very much.