We are building a backend service to pull historical analytics and need to decide between client_credentials and authorization_code grant types. Since this runs without user interaction, we assume client_credentials is the way to go, but we are seeing 403 Forbidden errors when trying to retrieve the dashboards summary for users in our org using the token generated from our service account. Is this endpoint restricted to user-scoped tokens only?