oauth2 client_credentials jasmin web api   

Boa tarde,

Tenho estado a desenvolver uma aplicação com o grant_type "client_credentials", e fiz o seguinte teste com o curl no command line, 
para perceber o tipo de parâmetros a usar nos 'GET's e 'POST's à API do Jasmin.
O que pretendo é perceber a razão pela qual o API não me devolve o objeto protegido, devolve "access forbidden", e o que não estou a usar como devido.

1. Obtenção do access_token
curl -ik https://identity.primaverabss.com/core/connect/token \
-H "Accept: application/json" \
-H "Accept-Language: en_US" \
-u "JASMIN-ITEMS:67bdc501-a421-4b3c-a6e4-56b5b1ddafaa" \
-d "grant_type=client_credentials"
==> Obtenho o acess_token dentro de um objeto, como suposto.

2. Obtenção de dados do recurso Protegido: url = 'https://my.jasminsoftware.com/api/235177/235177-0001/invoiceReceipt/invoices'
curl -i https://my.jasminsoftware.com/api/235177/235177-0001/invoiceReceipt/invoices \
-H "Content-Type: application/json" \
-H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IkFEM0Q1RDJERjM4OTZBMDUwMzYwNzVDQkNFNDc0RDJBMjI4MUVCM0UiLCJ0eXAiOiJKV1QiLCJ4NXQiOiJyVDFkTGZPSmFnVURZSFhMemtkTktpS0I2ejQifQ.eyJuYmYiOjE1ODgyNDkzNzAsImV4cCI6MTU4ODI2Mzc3MCwiaXNzIjoiaHR0cHM6Ly9pZGVudGl0eS5wcmltYXZlcmFic3MuY29tIiwiYXVkIjpbImh0dHBzOi8vaWRlbnRpdHkucHJpbWF2ZXJhYnNzLmNvbS9yZXNvdXJjZXMiLCJqYXNtaW4iXSwiY2xpZW50X2lkIjoiSkFTTUlOLUlURU1TIiwic2NvcGUiOlsiYXBwbGljYXRpb24iXX0.5sozlyKaH8gAaWv5EW6t90JpyR-S5STARLLrvbsQl_x2QSKYlgaD_-7ZeyZiDkSwoDlbPRxOedwiEo5puVhlGmnRorjP6XMWIzY_mcBpVXnfnXHWeefWj5qYSGo2bBmEFnfuMc1OX7i25cZwXRQJE4moqFzbpTPaWxhIAd0v42XBRRBceiH6PdvPZLfTxS3MCV0cNP_FG3H-5rcETDf32c-u0bMkcpVuN9XwMMihOF1mKSvg938CWB4MToqj_Wck8oMuR4bSn1pQ64uWSE1pGonjlDF4arWnsaCW5oc-lKULERjKp-UXlpijFYawKvPRJA_tP1JzF1Z3rOTMFHbowQ" \
-d '{
"documentType": "VFA"
}'
==> Resultado:

HTTP/2 400
content-type: application/json; charset=utf-8
server: Microsoft-IIS/10.0
request-context: appId=cid-v1:07e06186-bc8d-4628-9f1a-465b9a0bb54e
x-powered-by: ASP.NET
x-powered-by: ARR/3.0
date: Thu, 30 Apr 2020 15:43:37 GMT
content-length: 30

{
“message”: “Forbidden”
}%