.default scope does not work for Row-Level-Security report

[salesforcevy]

The sample code works for a "general" report, while I am trying to get a Row-Level-Security (RLS) app-owns report to render in Salesforce.

The access_token with scope = 'https://analysis.windows.net/powerbi/api/.default' renders the non-role report correctly with reqGetEmbedToken.setBody('{"accessLevel": "View", "datasetId": "' + powerBiReport.datasetId + '"}')

however, when I add identities to the request body and keep the rest of the code the same, I get error 403
reqGetEmbedToken.setBody('{"accessLevel":"View","identities":[{"username":"xx@xxx.onmicrosoft.com","roles":["HideJim"],"datasets":["00b4a1c3-d0e8-495f-aedc-0011bbf9797d"]}]}');

Can you help point me to the right scope or endpoint(s) api corresponding to RLS request?