Thanks for your reply and sorry for the delay in mine!
The issue was that the permissions for the API Token key I was using weren't enough to see "group permissions" (which is what's demoed in the example code).
Might be good to switch the example code to an API call that anyone could access - for example /api/user/current/.