Error 403 on pulling VO2 Max (cardio fitness)

[leerogers]

Hi there.  

I am trying to pull data at https://api.fitbit.com/1/user/-/cardioscore/date/YYY-MM-DD.json and getting a 403 (PERMISSION_DENIED) error.  I have scopes "activity profile sleep heartrate weight" granted in the authentication of the app and have authorized it.

SUCCESSFUL:

https://api.fitbit.com/1/user/-/activities/date/YYY-MM-DD.json
https://api.fitbit.com/1/user/-/body/log/weight/date/YYY-MM-DD.json
https://api.fitbit.com/1/user/-/activities/active-zone-minutes/date/YYY-MM-DD/1d.json

UNSUCCESSFUL:

https://api.fitbit.com/1/user/-/cardioscore/date/YYY-MM-DD.json
https://api.fitbit.com/1/user/-/spo2/date/YYY-MM-DD.json

The cardio fitness score is available in the app.

Am I missing a scope or something?

Thanks for any help.

[leerogers · Accepted solution]

Sorry, I found the problem in case anyone else sees these kinds of problems.  Right on the reference page, I found "Scope: cardio_fitness".  Added the scope to the oauth flow and it works.  SMH