Merge-Request/closes_issues returns 403

I have issues with the merge_request API endpoint.
I can for example update a MR or assign labels, but when I try to access the list of issues being closed I get a 403 permission denied.
The user is owner and the access token has all scopes.

Do you have any ideas what this could be?