Attempting to subscribe to userRevokedAccess results in 403 insufficient_scope

[JohnAtPaceline]

Hey everybody!

I would like to use the new userRevokedAccess subscription, but am getting "insufficient permissions" even though the docs say this:

• userRevokedAccess collection has no scope requirements

This is reproducible in the Fitbit Web API tester at https://dev.fitbit.com/build/reference/web-api/explore/#/Subscriptions/addSubscriptions if you choose a limited set of scope permissions when performing the OAuth authorization.  For instance, try choosing "activity", "heartrate", and "profile".

Specifically, this POST:

curl -X POST "https://api.fitbit.com/1/user/-/userRevokedAccess/apiSubscriptions/320.json" -H "accept: application/json" -H "authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiIyMjdHNUwiLCJzdWIiOiI4TkNSMksiLCJpc3MiOiJGaXRiaXQiLCJ0eXAiOiJhY2Nlc3NfdG9rZW4iLCJzY29wZXMiOiJ3aHIgd3BybyB3YWN0IiwiZXhwIjoxNTk2MjIwMjIxLCJpYXQiOjE1OTYxMzM4MjF9.bUaq3LDrPDUj8s1HfM8OsaMJCmmp4u6asK5yKOJn1yQ" -d ""

Receives this 403 response:

{
  "errors": [
    {
      "errorType": "insufficient_scope",
      "message": "This application does not have permission to access nutrition, settings, sleep, weight data. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
    }
  ],
  "success": false
}

Just wondering if there is a workaround or an imminent fix?  (We don't want to ask the user for all permissions because the sign up rate will decrease.)  

[GordonFitbit]

Hi @JohnAtPaceline 

Thank you for reporting the problem.   I'll investigate this for you.

Gordon

[GordonFitbit]

Hi @JohnAtPaceline 

Just wanted to let you know that we have filed a ticket to engineering to fix the issue.  I'll update this thread when the issue is fixed.  The only workaround I have for you is the user needs to consent to all scopes for you to add the subscription for userRevokedAccess.

[GordonFitbit · Accepted solution]

Hi @JohnAtPaceline 

We've identified the problem with the userRevokedAccess collection and pushed the fix to production.  I've tested the fix to make certain it works.   Would you please test your code to make certain it works for you and let me know if you have any problems?

Best,

Gordon

[JohnAtPaceline]

Verified that the latest production code works!  Thanks!