Wfm api returning 401 for bulk recording metadata export

No idea why this is happening, the wfm api endpoint /api/v2/wfm/scheduling/recordings is returning a 401 unauthorized error when querying for digital channel interactions. the oauth token is valid for 24 hours and works for voice exports. we are using the python sdk v2.1.4. the error payload shows {“code”: “unauthorized_request”, “message”: “invalid token scope”}. this is blocking our legal hold chain of custody verification. any ideas?