WordPress /users/me endpoint request forbidden

The subset of data you are seeing is the publicly available author data. ie. if a user has published content on the site, their name, gravatar and description is deemed public data and available to un-authenticated requests.

If you’re seeing this user data you can assume the access_token is invalid.