Very odd, looks like you have a correct token (user token not app access), but the API rejects it.
You sure your code doing the call to the ban’s API is using the right token in case you have multiple in play?
Aside from that it’s a really odd issue. Try running the call manually cURL on the command line, to check if it’s the token or your code.