As you mentioned, Dropbox has introduced new "scopes" functionality, to enable more granular permissions for API apps. You can find more information on this in our blog post.
Using the new scopes functionality is currently optional. You can still create non-scoped ("legacy") apps if you wish, and existing non-scoped apps continue to function as before.
If you have switched to scopes though, note that the scopes you enable for your app on the App Console are just the maximum set of scopes that your app will be able to use. Any specific access token for your app may have all or only some of those scopes. Also, if you enable more scopes for your app, that won't retroactively add those scopes to access tokens that already exist.
So, if you're getting a 'missing_scope' error like this, that indicates that the access token you're using to make the API call doesn't have the necessary scope for calling that endpoint. In this case, the necessary scope is 'files.metadata.read', as indicated by the 'required_scope'. You'll need to retrieve another access token with the necessary scope and use that instead. You can find information on how to do so in the OAuth Guide and authorization documentation.
