Are you using a User token, from the Auth Code or Implicit flow?
If the your token works fine for endpoints that don’t require user permissions, it’s likely you’ve used the Client Credentials flow and generated an App token, which can’t have scopes as it doesn’t represent a user.