According to example 12 here I should be able to use
dbus-send --system --print-reply --dest=org.freedesktop.NetworkManager /org/freedesktop/NetworkManager/Devices/4 org.freedesktop.NetworkManager.Device.Wireless.GetAllAccessPoints
to discover all available wireless access points, because /org/freedesktop/NetworkManager/Devices/4 is my wireless adaptor. However, it seems to return results different from the command-line equivalent
nmcli device wifi list
which returns many more SSIDs. Whilst experimenting with the above at work, I could only get one SSID via dbus-send. At home, the first time I ran the dbus-send command it returned an array of four access points, which is the same number as returned by nmcli. I ran the same dbus-send command again and this time it produced a list of only one access point, just as at work.
The next day at home I tried the dbus-send command several times and it listed just one access point. I then ran the nmcli command again and it listed five access points. After that, the dbus-send command also listed five access points. It seems that the nmcli command somehow goes further than the dbus-send command to discover access points, but once it has done so, the dbus-send command is also able to find the access points. That is not the case at work, however: the nmcli command always discovers 12 or more APs but the dbus-send command only ever discovers one.
I definitely only have one wireless adaptor: ifconfig -a lists: enp0s25, lo, sit0 and wlp3s0.
What does the nmcli command that the dbus-send command does not?
The answer is that you have to run a rescan (method RequestScan) just before getting the list of SSIDs.