Getting 403 Forbidden when calling /api/v2/routing/queues — which OAuth scope is needed

We’re building an Android app using the Genesys Cloud Web Messaging SDK and trying to fetch available queue details for a specific engagement. The app has a valid OAuth token, but calling GET /api/v2/routing/queues returns 403 Forbidden.

Here’s the request setup:

val request = Request.Builder()
 .url("https://{{env}}.mygenesys.com/api/v2/routing/queues")
 .header("Authorization", "Bearer $token")
 .header("Accept", "application/json")
 .build()

client.newCall(request).enqueue(object : Callback {
 override fun onFailure(call: Call, e: IOException) { ... }
 override fun onResponse(call: Call, response: Response) { ... }
})

The token is obtained via client credentials flow with urn:genesys:cloud:api:scope:webmessaging:all and urn:genesys:cloud:api:scope:agent:all. We assumed agent:all would cover queue reads, but no luck. The error payload is just {"code": "forbidden", "message": "The caller does not have the required permissions."}.

Did we miss a specific scope for routing endpoints? Or is there a different approach for fetching queue info in a web messaging context? We’ve checked the docs but the scope mapping for mobile SDK scenarios isn’t super clear. Any pointers?