Cloud Identity API: 403 Forbidden

[Mugenor]

I'm trying to access cloud identity API using service account, but getting 403 Forbidden error.
I've created a service account with "Identity Platform Admin" role as suggested here,  created and downloaded a key for testing purposes, but I getting this error when trying to access the API:

GET https://cloudidentity.googleapis.com/v1/groups:lookup?groupKey.id=mygroup@email.com
{
  "code": 403,
  "details": [
    {
      "@type": "type.googleapis.com/google.rpc.ResourceInfo",
      "resourceType": "cloudidentity.googleapis.com/Group",
      "resourceName": "mygroup@email.com",
      "owner": "domain:cloudidentity.googleapis.com",
      "description": "Error(2028): Permission denied for resource mygroup@email.com (or it may not exist)."
    }
  ],
  "errors": [
    {
      "domain": "global",
      "message": "Error(2028): Permission denied for resource mygroup@email.com (or it may not exist).",
      "reason": "forbidden"
    }
  ],
  "message": "Error(2028): Permission denied for resource mygroup@email.com (or it may not exist).",
  "status": "PERMISSION_DENIED"
}

If I switch to application default authentication, it's working as expected.
Here is the code I'm using:

        GoogleCredentials creds = GoogleCredentials.fromStream(new FileInputStream("./creds.json"))
            .createScoped(
                "https://www.googleapis.com/auth/cloud-identity.groups",
                "https://www.googleapis.com/auth/cloud-identity.groups.readonly",
                "https://www.googleapis.com/auth/cloud-platform"
            );
        creds.refreshIfExpired();

        CloudIdentity service = new CloudIdentity.Builder(
            Utils.getDefaultTransport(),
            Utils.getDefaultJsonFactory(),
            new HttpCredentialsAdapter(creds)
        ).setApplicationName("My app name")
            .build();

        String parent = "mygroup@email.com";
        LookupGroupNameResponse lookupResponse = service.groups().lookup().setGroupKeyId(parent).execute();
        System.out.println(lookupResponse.getName());