Do I need to configure some permissions for my client_id and client_secret somewhere?
After obtaining a bearer token I did:
curl -v 'https://api.personio.de/v1/company/employees/XZY' -H "authorization: Bearer $TOKEN" --header 'Accept: application/json'
{"success":true,"data":{"type":"Employee","attributes":{"id":{"label":"ID","value":XYZ}}}}