How to get metadata of Dam Asset while accessing an asset through Asset API from 3rd party app

1. I have no insight into the user generation process you describe. Presumably this user "lives" as long as the lifespan of the access token returned by the JWT exchange process. After the exchange process, I searched the user/group lists for plausible candidates ("oauth", "api", "cloud", "integration") with no luck.

2. I am presuming that adding jcr:all to a path will cause that permission to be inherited by all folders/assets below that path. If I'm mistaken about this then applying to /content/dam might be insufficient

The code (PHP) follows. As to the question about seeing a new oauth user, I don't see any new users created after the JWT exchange.  Also, the JWT exchange is successful and generate an access token that results in a successful asset api request that is identical to my request made with a local development token, except that the metadata property is empty.

<?php
declare(strict_types=1);

namespace LAZ\objects\shared\AdobeExperienceManager\services;


use Doctrine\Common\Cache\Cache;
use Exception;
use Firebase\JWT\JWT;
use GuzzleHttp\Client;
use LAZ\objects\library\HttpStatus;
use LAZ\objects\library\Router\Exception\ForbiddenException;
use LAZ\objects\shared\AdobeExperienceManager\AccessTokenProvider;
use LAZ\objects\shared\AdobeExperienceManager\LazAemInstance;
use stdClass;

class AemServiceCredentialAuthService implements AccessTokenProvider
{
    const EXPIRATION_SECONDS_INTERVAL = 60 * 60;
    private Cache $cache;
    private LazAemInstance $aemInstance;

    public function __construct(Cache $cache, LazAemInstance $aemInstance)
    {
        $this->cache = $cache;
        $this->aemInstance = $aemInstance;
    }

    public function getServiceCredentials(): ?stdClass {
        $aemEnv = $_ENV['AEM_AUTHORING_ENV'];
        $aemVaultDir = $_ENV['AEM_VAULT_DIR'];
        $serviceTokenFile = "$aemVaultDir/service_token_$aemEnv.json";
        $credentialsStr = file_get_contents($serviceTokenFile);
        if ($credentialsStr === false) {
            throw new Exception("Unable to read AEM service credentials from $serviceTokenFile");
        }
        return json_decode($credentialsStr);
    }

    public function exchangeJwt(stdClass $options😞 stdClass {
        $imsEndpoint = $options->imsEndpoint;
        $clientId = $options->clientId;
        $jwtPayload = [
            'iss' => $options->issuer,
            'sub' => $options->subject,
            'exp' => $options->expirationTimeSeconds,
            'aud' => "https://$imsEndpoint/c/$clientId",
        ];
        foreach ($options->metascopes as $metascope) {
            $metascopeKey = "https://$imsEndpoint/s/$metascope";
            $jwtPayload[$metascopeKey] = true;
        }
        $jwtToken = JWT::encode($jwtPayload, $options->privateKey, 'RS256');
        $client = new Client();
        $uri = "https://$imsEndpoint/ims/exchange/jwt";
        $response = $client->post($uri, [
            'form_params' => [
                'client_id' => $options->clientId,
                'client_secret' => $options->clientSecret,
                'jwt_token' => $jwtToken,
            ],
//            'debug' => fopen($_ENV['LOG_PATH'] . '/GuzzleHttp.log', 'a+'),
        ]);
        $statusCode = $response->getStatusCode();
        if ($response->getStatusCode() !== HttpStatus::OK) {
            if (in_array($response->getStatusCode(), [HttpStatus::UNAUTHORIZED, HttpStatus::FORBIDDEN])) {
                throw new ForbiddenException();
            }
            throw new Exception("Bad status: $statusCode @ $uri\n");
        }
        return json_decode($response->getBody()->getContents());
    }

    public function getAccessToken(): string {
        $cacheKey = 'AemServiceCredential.AccessToken.' . $this->aemInstance->getAuthoringHost();
        $accessToken = $this->cache->fetch($cacheKey);
        if ($accessToken === FALSE) {
            $accessToken = $this->getAccessTokenFromServiceCredentials();
            $this->cache->save($cacheKey, $accessToken);
        }
        return $accessToken->access_token;
    }

    public function getAccessTokenFromServiceCredentials(): stdClass {
        $serviceCredentials = $this->getServiceCredentials();
        return $this->exchangeJwt((object)[
            'imsEndpoint' => $serviceCredentials->integration->imsEndpoint,
            'issuer' => $serviceCredentials->integration->org,
            'subject' => $serviceCredentials->integration->id,
            'expirationTimeSeconds' => time() + self::EXPIRATION_SECONDS_INTERVAL,
            'metascopes' => explode(',', $serviceCredentials->integration->metascopes),
            'clientId' => $serviceCredentials->integration->technicalAccount->clientId,
            'clientSecret' => $serviceCredentials->integration->technicalAccount->clientSecret,
            'privateKey' => $serviceCredentials->integration->privateKey,
        ]);
    }
}