CXone client_credentials grant returns 400 with invalid_scope

Trying to get an OAuth token for our WEM reporting script using client_credentials. The POST to https://api.nice-incontact.com/oauth2/token fails with 400 Bad Request and {“error”:“invalid_scope”}. Here is the payload:

client_id=our_client_id&client_secret=our_secret&grant_type=client_credentials&scope=analytics:read

We’ve verified the credentials are correct. What scopes are actually valid for this grant type in CXone?