GetProvisioningTemplate Access Denied when using custom access token

I am retrieving an authorization and access token using the authorization_code grant_type and scope Sites.FullControl.All which is working fine with the SharePoint REST API and also when passed in to the ClientContext. However when trying to call web.GetProvisioningTemplate I get the following error:

[PnP.Framework] [0] [Error] ExecuteQuery threw following exception: Microsoft.SharePoint.Client.ServerUnauthorizedAccessException: Sorry, this site hasn't been shared with you.

Which isn't true as the user credentials used to request a token is in the SCA group and the token works correctly with the REST API and retrieving data using the ClientContext.

I am configuring the ClientContext with the token as below.

ctx.ExecutingWebRequest += (sender, e) => { e.WebRequestExecutor.RequestHeaders["Authorization"] = "Bearer " + token; };

And then calling ProvisioningTemplate template = ctx.Web.GetProvisioningTemplate();

Does GetProvisioningTemplate need any special permissions? What have I missed?

Start with the ClientContext configuration and the Web.GetProvisioningTemplate() call described in the issue, then compare the custom access token's behavior with the SharePoint REST API and other ClientContext requests. Determine whether the provisioning call requires different permissions or token configuration; done means identifying the missing requirement and confirming that GetProvisioningTemplate succeeds.