Attempting to subscribe to userRevokedAccess results in 403 insufficient_scope

[JohnAtPaceline]

Hey everybody!

I would like to use the new userRevokedAccess subscription, but am getting "insufficient permissions" even though the docs say this:

• userRevokedAccess collection has no scope requirements

This is reproducible in the Fitbit Web API tester at https://dev.fitbit.com/build/reference/web-api/explore/#/Subscriptions/addSubscriptions if you choose a limited set of scope permissions when performing the OAuth authorization.  For instance, try choosing "activity", "heartrate", and "profile".

Specifically, this POST:

curl -X POST "https://api.fitbit.com/1/user/-/userRevokedAccess/apiSubscriptions/320.json" -H "accept: application/json" -H "authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiIyMjdHNUwiLCJzdWIiOiI4TkNSMksiLCJpc3MiOiJGaXRiaXQiLCJ0eXAiOiJhY2Nlc3NfdG9rZW4iLCJzY29wZXMiOiJ3aHIgd3BybyB3YWN0IiwiZXhwIjoxNTk2MjIwMjIxLCJpYXQiOjE1OTYxMzM4MjF9.bUaq3LDrPDUj8s1HfM8OsaMJCmmp4u6asK5yKOJn1yQ" -d ""

Receives this 403 response:

{
  "errors": [
    {
      "errorType": "insufficient_scope",
      "message": "This application does not have permission to access nutrition, settings, sleep, weight data. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
    }
  ],
  "success": false
}

Just wondering if there is a workaround or an imminent fix?  (We don't want to ask the user for all permissions because the sign up rate will decrease.)  

[JohnFitbit]

Hi @JohnAtPaceline,

Thanks for reporting this! I too was able to reproduce this issue. I'll file a ticket to the team and have this corrected as soon as possible.

Thanks!

[EthanChid]

I'm seeing nearly identical behaviour from our integration after trying to subscribe to userRevokedAccess notifications. The error we see is:

This application does not have permission to access nutrition, settings, sleep data.

 We get permission for 'activity heartrate profile weight' scopes in our authentication flow.

[Gordon-C]

Thank you, @EthanChid .   We are working on a fix for the userRevokedAccess collection.

[JohnAtPaceline · Accepted solution]

Hey everybody.  This issue got double-posted.  The problem has been fixed and marked as resolved here: https://community.fitbit.com/t5/Web-API-Development/Attempting-to-subscribe-to-userRevokedAccess-res...

[EthanChid]

Yes, it's working for me now. Thanks for the quick response