Getting list of sharepoint pages in a collection returns 403

I have these permissions on a service account:

1. With this service account's clientId and clientSecret, I call GET https://login.microsoftonline.com/41ff26dc-250f-4b13-8981-739be8610c21/oauth2/v2.0/token to get an access_token.

2. I use this access_token to call POST https://slb001.sharepoint.com/sites/STICRadars/_api/web  but get a 401.

{
"error_description": "Exception of type 'Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException' was thrown."
}

So I have two questions:

1. Do I not have the right permissions? The Sites.Selected should include the <sitecollection>.

2. What permissions do I need to get a 200?