Able to list collections but not query a collection with Cosmos DB REST API

As a follow-up from this (thank you @Saurabh Sharma ), I'm able to get a list of collections, but following these instructions I'm not able to query against a particular collection:

   var url =  
           'https://$_account.documents.azure.com/dbs/$databaseName/colls/$_locks/docs';  
       var uri = Uri.parse(url);  
       var headers = {  
         'Authorization': 'type=aad&ver=1.0&sig=${token['access_token']}',  
         'Content-Type': 'application/query+json',  
         'x-ms-date': DateTime.now().asRfc1123(),  
         'x-ms-documentdb-isquery': 'True',  
         'x-ms-session-token': _sessionId,  
         'x-ms-version': '2018-12-31',  
       };  
       var body = {  
         'query':  
             'SELECT l.id FROM $_locks l WHERE l.id = @id AND l.session = @session',  
         'parameters': {  
           'id': id,  
           'session': _sessionId,  
         },  
       };  
       var response;  
       try {  
         response = await http.post(uri, headers: headers, body: jsonEncode(body));  
       } catch (e) {  
         throw StateError(e.toString());  
       }  
       if (response.statusCode != 200) {  
         throw StateError(response.body);  
       }  

yields:

   StateError (Bad state: {"code":"BadRequest","message":"The session token provided 'bae...23f' is invalid.  

I'm providing the same token as before, so I suspect that there is a different permission needed for data from metadata but I'm not able to find it. I've assigned the "00..02" role-definition-id and using the .default scope when obtaining the initial token.