See if your issue ends up being the same set of permissions that resolved this recent question.
Also double check, in case you are using app-only permissions, that an administrator has also given “consent.” That second step in Microsoft’s API security approach is a little unusual and easily missed.