Problem with OAuth2 refresh token
Status code 403 (Forbidden) does not mean that you are not properly authenticated. Since you received all tokens properly you are authenticated successfully. 401 Unauthorized means that you do not have a proper token, i.e. you are not authenticated).

If you receive 403 then you simply are not allowed to access the requested resource with the token you presented. The account you used does not have access privilege for whatever you are trying to access.

If I would have to guess:


Either you used the wrong account (e.g. Stage account used on Production) => use the correct account
Your account was not set up to access the endpoint. => talk to whoever created the account


Edit:
It comes down to "Authentication != Authorization" ("who am I" vs. "what am I allowed to do").