Google service python API fails: is it a bad parameter (400) or a failed authentication (401)?

I'm working with the mybusinessbusinessinformation API, attempting to get a list of locations. The documentation for this API is here.

I have already taken the following steps:

• Filled out the form and basic setup
• Gotten approval from Google's people
• Generated an OAuth 2.0 secret and saved it to my local
• Enabled the My Business Business Information API in my project's GCP console

Here is my code:

import os, json
from google.auth.transport.requests import Request
from google.oauth2.credentials import Credentials
from google_auth_oauthlib.flow import InstalledAppFlow
from googleapiclient.discovery import build

CLIENT_SECRET_FILE = "E:\\catphotos\catapultphotos\myhappysecret.json"
SCOPES = ['https://www.googleapis.com/auth/business.manage'
,'https://www.googleapis.com/auth/mybusiness.businessinformation']
TOKEN_FILE = 'token.json'

### Generate a credentials flow
def get_credentials():
    creds = None
    # Check if the token file exists
    if os.path.exists(TOKEN_FILE):
        creds = Credentials.from_authorized_user_file(TOKEN_FILE, SCOPES)
    # If there are no valid credentials available, let the user log in
    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:
            creds.refresh(Request())
        else:
            flow = InstalledAppFlow.from_client_secrets_file(CLIENT_SECRET_FILE, SCOPES)
            creds = flow.run_local_server(port=0)
        # Save the credentials for the next run
        with open(TOKEN_FILE, 'w') as token:
            token.write(creds.to_json())
    return creds

### generate credentials, build service, pass account number for API
credentials = get_credentials()
service = build('mybusinessbusinessinformation','v1', credentials=credentials)
accountum = "999999999999"
output = service.accounts().locations().list(parent='accounts/%s' %accountnum, readMask='locations').execute()

When I execute this code, I get this error, which suggests that I'm mis-specifying a parameter, read_mask.

However when I click the hyperlink in the error response I get this error json, which suggests failed authentication:

{
  "error": {
    "code": 401,
    "message": "Request is missing required authentication credential. Expected OAuth 2 access token, login cookie or other valid authentication credential. See https://developers.google.com/identity/sign-in/web/devconsole-project.",
    "status": "UNAUTHENTICATED",
    "details": [
      {
        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
        "reason": "CREDENTIALS_MISSING",
        "domain": "googleapis.com",
        "metadata": {
          "method": "google.mybusiness.businessinformation.v1.Locations.ListLocations",
          "service": "mybusinessbusinessinformation.googleapis.com"
        }
      }
    ]
  }
}

I know this is difficult to replicate because of the legwork necessary to set up, but I appreciate your guidance and thoughts of next paths.