Getting a 403 for /drives/{drive-id}/root/search(q='{q}') using app token

Hello,

I'm getting a 403 for a GET request to /drives/{drive-id}/root/search(q='{q}'). I'm using an app token that has the following permissions and it works for GET /drives/{drive-id} and GET /drives/{drive-id}/root/children

  "aud": "https://graph.microsoft.com",
  "roles": [
    "Files.ReadWrite.All",
    "Files.Read.All"
  ],

Documentation (https://learn.microsoft.com/en-us/graph/api/driveitem-search?view=graph-rest-1.0&tabs=http&source=docs) seems to say it should work. Am I missing something?