API scope for private messages

What’s the API scope that gives permission for
https://{defaultHost}/topics/private-messages/{username}.json ?

Within a separate admin panel of our own, we are trying to show a table of pending support group messages that haven’t been replied to (in Discourse), but without creating an API token with ALL access. The read permission doesn’t seem to do it: