How can I delete supporting documents via API

If a signer uploads documents to a contract that are only used to confirm his details, the GDPR states that these may not be stored further. E.g. employment contract or copy of his identity card.
How can I delete these attachments via API?

If I try it with DELETE /agreements/{agreementId}/documents, it results into "PERMISSION_DENIED: The API caller does not have the permission to execute this operation".
The user should have the agreement_retention scope, but I can't set it for Integreation Key or OAuth App in my developer account - is not listed. And yes, I have enabled the Privacy Administrator option for my user.