I have a Box app with a valid Client ID and Client secret. The app is set to App + Enterprise Access. I also have “Manage Enterprise Properties” checked. I can receive a Bearer Token using the Client ID and Client secret. However, when I try to retrieve events using curl

curl -i -X GET "https://api.box.com/2.0/events" \
     -H "authorization: Bearer <ACCESS_TOKEN>"

I get this

HTTP/2 200 
date: Fri, 11 Jul 2025 06:38:55 GMT
content-type: application/json
x-envoy-upstream-service-time: 70
strict-transport-security: max-age=31536000
box-request-id: 0ad50df19baed02f845ec8d10931bcb48
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{"entries":i],"next_stream_position":30401049700682011,"chunk_size":0}%    

Why is my entries empty?