I've been doing some more testing with SoapUI, Postman and Google Developer Playground, in the latest release with sample data. Whilst each of these systems have been able to get an access token, both SoapUI and Google have usually failed with a 403 error when getting data. Postman was usually able to get data, even using the access token from either of the other two systems. Also, after Postman had got the data, it was then usually possible to get the data from the other two systems.
However, after restarting the SERP server, I have not been able to get data from any of the three systems, as they all return a 403 response.
I've been working with Simone on this and we're hoping to escalate this further.