Oauth API to retrieve recordings

We have an Oauth webhook API

when users click link to auth app everything is fine and we get user token we then use this token appended to URL to download recordings for that user which used to work

we are now get a HTML file retuned instead of MP3 with error 200 no permission

all scopes are correct anyone know whats causing this?

all users are admins in portal so it cant be a role permission.

anyone? out of 250 feeds we have developed for collection zoom has to be the worst. but we have a requirement to do it so can someone please assist