Thank you for the information regarding the IP restrictions. Per that link my colleague mentions that Salesforce requires full as a scope in certain circumstances - not that n8n does.
I’ll check with our engineering team during Berlin operating hours tomorrow and check whether we also in fact require that scope or another and a change is needed in our documentation.