The answear is that you have to remove the read:guardian-factors from the checked scopes.

This is in case you checked all the scopes for your api (like I did) and like this documentation suggests.