OAUTH_SCOPE_MISMATCH is displayed when Upload on Attachment of Zoho API is used

Hi!

I am developing a contact form using the Zoho API.

https://www.zoho.com/crm/help/api/v2/#upload-an-attachment

I'd like to implement a program to add attachments to Leads by referring to this page, but I can not do it well.
A 401 error of OAUTH_SCOPE_MISMATCH is returned as a response.

If you have a solution please let me know.

【Procedure so far 】

※ Secret information is hidden by "???".

①Acquire permission to use API.

https://accounts.zoho.com/oauth/v2/auth?scope=ZohoCRM.modules.leads.ALL&client_id={id}&response_type=code&access_type=offline&redirect_uri={uri}

②Acquire Refresh Token.

https://accounts.zoho.com/oauth/v2/token?code={code}&redirect_uri={uri}&client_id={id}&client_secret={secret}&grant_type=authorization_code

③Record information from inquiry form to Leads.

https://www.zohoapis.com/crm/v2/Leads?scope=ZohoCRM.modules.leads.create

header： 'Content-type: application/json; charset=\"utf-8\"',

　　　　 'Authorization: Zoho-oauthtoken {access_token}

④Acquire the ID value from the response data

$id = $id = $response["data"][0]["details"]["id"];

⑤Upload attachments → Failure

https://www.zohoapis.com/crm/v2/Leads/ ' . $id . '/Attachments?scope=ZohoCRM.modules.leads.create

※HTTP Request

POST /crm/v2/Leads/2793615000001658015/Attachments?scope=ZohoCRM.modules.leads.ALL HTTP/1.1 Host: www.zohoapis.com Accept: */* Authorization: Zoho-oauthtoken {access_token} Content-Length: 55545 Content-Type: multipart/form-data; boundary=------------------------a649f045bef0317d Expect: 100-continue

※HTTP Response

HTTP/1.1 100 Continue HTTP/1.1 401 Unauthorized Server: ZGS Date: Thu, 16 Aug 2018 17:09:02 GMT Content-Type: application/json;charset=utf-8 Content-Length: 113 Connection: keep-alive Set-Cookie: 6726760df9=097d1e8a5f4f275774525e2143b1676b; Path=/ Cache-Control: no-cache X-Content-Type-Options: nosniff Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-XSS-Protection: 1 Set-Cookie: crmcsr=7e809a97-a21c-4831-aacc-c44ebc2e01d6;path=/;Secure;priority=high Set-Cookie: JSESSIONID=4A7FEFA7EFCE9DF126DEADBC1977222A; Path=/; Secure X-Download-Options: noopen {"code":"OAUTH_SCOPE_MISMATCH","details":{},"message":"invalid oauth scope to access this URL","status":"error"}

Is it a bug in Zoho API v2?

Please tell me if there is a solution.

Thank You!!