What OAuth scope does a service account API token need to read Assets objects via REST?

[Ash Sundar]

I'm using an Atlassian service account with an API token to read Jira Service Management data. Reading work items works fine using the https://api.atlassian.com/ex/jira/{cloudId} base URL.
However, when I try to read an Assets object via:
GET https://api.atlassian.com/ex/jira/{cloudId}/jsm/assets/workspace/{workspaceId}/v1/object/{objectId}
I get:
401 Unauthorized; scope does not match
When I set up the token scopes, I can only find the standard Jira scopes (read:jira-user, read:jira-work, read:servicedesk-request) — none of which seem to cover Assets.
I'm a bit stuck on how to proceed. Which scope do I need to add to the token so the service account can read Assets objects? And where do I find it when configuring the token's scopes?
Thanks in advance.

[David Nickell]

Here's the "no explanation offered answer"  read:cmdb-object:jira

---

Read on for the background:

Why I say that... I built a REST API Browser from the documentation Atlassian Provides but few people probably notice.

My REST Browser (free - help yourself): 

The Atlassian documents:

• The api documents can be found here: https://developer.atlassian.com/cloud/
• There are a dozen or more when you finally dig in, this is the one you want for Assets: https://developer.atlassian.com/cloud/assets/rest/api-group-aql/
• If you look at the method, you will see the  requirement

In the screen shots attached, you will see what many people miss (I assume).  And here is a screenshot from my browser, and their doc.   Enjoy!