sync script fails (403)

According to your documentation to sync your repositories to a self-managed GitLab I used the following command:

curl -s https://gitlab.com/to-be-continuous/tools/gitlab-sync/-/raw/master/gitlab-sync.sh | bash /dev/stdin --dest-api https://<our GitLab instance>/api/v4 --dest-token $GITLAB_TOKEN --exclude samples,custom

GITLAB_TOKEN is set as well our GitLab instance name.

Output:

[INFO] Synchronizing GitLab group
[INFO] - src group   (--src-sync-path)  : to-be-continuous
[INFO] - dest group  (--dest-sync-path) : to-be-continuous
[INFO] - from        (--src-api)        : https://gitlab.com/api/v4
[INFO] - to          (--dest-api)       : https://<our instance>/api/v4
[INFO] - max visi.   (--max-visibility) : public
[INFO] - exclude     (--exclude)        : samples,custom
[INFO] - disable group desc. sync   (--no-group-description)   : false
[INFO] - disable project desc. sync (--no-project-description) : false
[INFO] Synchronizing group to-be-continuous (parent group ID null)
[INFO] ... destination group found: synchronize
curl: (22) The requested URL returned error: 403

As the destination group was found I assume the general connection is working.

Providing an invalid token results in an unexpected error:

curl -s https://gitlab.com/to-be-continuous/tools/gitlab-sync/-/raw/master/gitlab-sync.sh | bash /dev/stdin --dest-api https://<our instance>/api/v4 --dest-token yDGx16
XVxgNtJhzLwk1tdsd --dest-sync-path to-be-continuous --exclude samples,custom
[INFO] Synchronizing GitLab group
[INFO] - src group   (--src-sync-path)  : to-be-continuous
[INFO] - dest group  (--dest-sync-path) : to-be-continuous
[INFO] - from        (--src-api)        : https://gitlab.com/api/v4
[INFO] - to          (--dest-api)       : https://<our instance>/api/v4
[INFO] - max visi.   (--max-visibility) : public
[INFO] - exclude     (--exclude)        : samples,custom
[INFO] - disable group desc. sync   (--no-group-description)   : false
[INFO] - disable project desc. sync (--no-project-description) : false
[INFO] Synchronizing group to-be-continuous (parent group ID null)
[ERROR] ... unexpected error: 401

Hence the 403 happens here (line 273):

dest_group_json=$(curl -sSf -H "${DEST_TOKEN+PRIVATE-TOKEN: $DEST_TOKEN}" -H "Content-Type: application/json" -X PUT "$DEST_GITLAB_API/groups/$dest_group_name" \
          --data "{
            \"name\": $(echo "$src_group_json" | jq .name),
            \"visibility\": \"$dest_visibility\",
            \"description\": $(echo "$src_group_json" | jq .description)
          }")

But I don't now why ...

The used access token has the scopes scopes api,read_repository,write_repository activated. But not read_registry,write_registry as they weren't available at our instance. We are using gitlab 14.8.2-ee.

Any idea what could be the problem?