Listing shelf contents is forbidden when privacy set to "just my friends"

[Matt]

When I try to list the books in my shelves, I get a forbidden response. I've authenticated using my own account. If I change my privacy settings for "Who can view my profile" from "just my friends" to "anyone (including search engines)", I can now list the shelf contents. Is this the expected behavior? I would have expected I could list my contents if I have authorized the access.

This is the URL I'm requesting: https://www.goodreads.com/review/list...
Am I simply formulating the request incorrectly?

[Ettore]

Can you please post an example of the actual request you're submitting and how you are submitting it? E.g. a easy way to test OAuth requests is using Postman, an extension for google chrome.