Discover Workspace and or user with access token

We want to allow customers to grant us access to some of their resources (Repos, PRs) by providing an access token. With said token (for now we’re trying to accommodate any scope: Workspace, Project, or Repository) the first thing we’re trying to do is discover the scope, workspace, username, etc… but none of the endpoints (/user, /user/permissions/workspaces, /workspaces, etc) seem to work. All we get is 401’s or 403’s. We did provide “account” scope to the tokens on creation.
What are we doing wrong?

Put more simply: If I have an access token, what endpoint can I use to discover the workspace the token is scoped to?