Okay, that all looks correct. What is the clientId that you setting?
As for access tokens, the endpoint that you’re calling does accept an access token for certain types of calls. Just wanted to make sure that you didn’t provide one since they are secret. 