Correct permissions for Read on v2/attachments

I’m trying to find the right permission for GET on the /api/v2/attachments/ endpoint

ie,

curl -X GET \ -H “Authorization: Bearer YOUR_ATLASSIAN_ACCESS_TOKEN” \ -H “Accept: application/json” \ -H “Content-Type: application/json” \ "https://api.atlassian.com/ex/confluence/YOUR_CLOUD_ID/wiki/api/v2/attachments/LINK_ID"I

I thought it would be…

View and download content attachments

View and download attachments of a page or blogpost that you have access to.

read:attachment:confluence

…but I’m getting…

{
“success”: false,
“error”: true,
“message”: “Atlassian authentication failed: Insufficient permissions. Please disconnect and reconnect your Atlassian account to update OAuth scopes for Confluence access.”,
“details”: “HTTP 500”,
“tool”: “confluence”,
“action”: “get_attachments”
}

I’ve tried loads of other permissions too, and always re-oauth

What permission am I missing? Or is it something else?

To be clear, my goal is to take a known attachment ID (ie, att0000000000) and get a link to the page it’s in (plus whatever else might come back from such an end point)

TIA