Keycloak rest api 401 Unauthorized - jwt

Question

I cannot get a normal rest api call to keycloak (v19) working.
What i want is that a "normal" user can query for all other KeyCloak users
What iam doing:
create realm "TestRealm"
create client "apiclient", with client authentication on and service account on
go to clients -> service account and assign roles "view-users" & "query-users" of the realm-management client to service account.
create user "TestUser"
assign roles "view-users" & "query-users" to the new user
Now i think everything is done and i can test the api:
Get the access token:
curl --location --request POST 'http://localhost:8081/realms/TestRealm/protocol/openid-connect/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=apiclient' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username=TestUser' \
--data-urlencode 'password=ABC' \
--data-urlencode 'client_secret=ABC'
Token contains these values:
"realm_access": {
"roles": [
"offline_access",
"uma_authorization",
"default-roles-testrealm"
]
},
"resource_access": {
"realm-management": {
"roles": [
"view-users",
"query-groups",
"query-users"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
Now the query for all users:
curl --location --request GET 'http://localhost:8081/admin/realms/TestRealm/users' \
--header 'Authorization: Bearer {{keycloak-bearer-token}}'
Response is "401 Unauthorized".
I dont know what iam doing wrong
EDIT: i had an issue somewhere else and these steps work exactly as expected