It looks like you are using a refresh token that doesn't have the required activity:read_all scope.

This is likely because you're using the refresh token provided on the Strava API settings page. As noted in the documentation, that token does not include all necessary scopes and won't work. To restart the authorization flow:

Start Strava authorization flow