401 Unauthorized; scope does not match" on Media Services /file/{fileId}/binary with 3LO Token (Confluence Attachment Download)

Confluence Development Confluence Cloud
,
1

What is the current, exact 3LO scope required to download a Confluence attachment via Media Services /file/{fileId}/binary endpoint?