Data action http 401 on snow rest api for gdpr scrub

Does anyone understand why the genesys cloud data action returns a 401 unauthorized when calling the servicenow incident api via oauth2 client credentials? the token endpoint returns a valid access token, verified in postman. however, the data action fails at runtime. flow triggers on chat disconnect. json payload matches snow docs. checking logs shows the token is passed but rejected by snow. is there a scope mismatch or a known issue with the data action oauth implementation in eu-west-1?