API client is not authorized by Fitbit to access the resource requested.

[mim2503]

I tried to read the HRV values with my Personal type App.

I got the error "API client is not authorized by Fitbit to access the resource requested."

I tried to reset the tokens as described by @Unitcircle with no success

From an example I tried the following call:

curl -X GET "https://api.fitbit.com/1/user/-/hrv/date/2022-06-16/all.json" -H "accept: application/json" -H "authorization: Bearer <token>"

Response:
API client is not authorized by Fitbit to access the resource requested. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process.

[mommi84]

Same problem here. My access token is supposed to be able to access heart data.

Even the HRV summary endpoint does not seem to work properly. There, I get an empty result instead of the unauthorised message.

{
    "hrv": []
}

[PlayerNotFound]

Faced the same problem.
HRV and BR intaday requests return the same response, but summary requests work well.
@mommi84 recently, I had no hrv data in the Fitbit app(health metrics) and got the same response. Probably, you have no data at the day you requested. Try to request a day with available hrv data.

[Gordon-C]

Hi everyone,

We understand querying the SpO2, HRV and Br intraday data using the personal application type is not working now.   I'm working with the engineering teams to implement a fix.   In the meantime, if accessing the intraday for these endpoints is urgent, please submit an intraday request at https://dev.fitbit.com/build/reference/web-api/intraday/

[clintonb]

Please update the documentation to reflect the fact that this data is currently inaccessible to personal applications. I wasted a lot of time trying to debug this issue before finding this forum post.

Also, is there an ETA for fixing this bug? My application for intraday access was rejected years ago, so my users (https://apps.apple.com/us/app/fitsync/id1501104649) must make their own OAuth applications in order to access their personal data. Forcing them to also complete the intraday request form is a non-starter.

[Gordon-C]

Hi everyone,

We have fixed the problem where applications could not retrieve HRV and Breathing Rate intraday data for "personal" applications.   We are still working on SpO2.   We will update the community posts when SpO2 is available.

Gordon

[clintonb]

Any update on SpO2?

[Gordon-C]

Yes, SpO2 is fixed.   

[lsgreen]

Hi Gordon,

You said "personal" applications only. Is it fixed for client and server applications? 

[Gordon-C]

Hi @lsgreen 

There wasn't a problem pulling the data with the client or server application types.   Are you having problems?

Gordon

[djp238]

Hi Gordon,

I'm still unable to pull spo2 data, I can see the data is there on swagger, but when I try from my personal application I get a 403 for the same endpoint:

/1/user/-/spo2/date/today.json

[Gordon-C]

Hi @djp238 

What is your application type set to in the client ID registration on dev.fitbit.com?   If it is personal, then the access token needs to be for the owner of the application.   You can use the introspect endpoint to verify the user id and scopes of the access token.

Gordon