Using Cloud Identity API with a Service Account?

[matthew_hynes]

I am having a problem trying to access the Cloud Identity API with an auth token generated for a Service Account

curl -X GET -H "X-Goog-User-Project: $PROJECT_ID" -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" 'https://cloudidentity.googleapis.com/v1/groups?parent=customers/$CUSTOMER_ID'

The previous command works just fine if I generate a token as the project owner, but trying to access the same with an auth token generated for a service account doesn't

Does anyone know what permissions I need to grant to the Service Account in order for this to work?