Get list of subscriptions fails due to insufficient_scope:nutrition

[Alegis]

Hi,

We no longer get notifications on data changes for some users, so I wanted to verify if the subscription for that user was still active.

I noticed the following error when performing a

GET https://api.fitbit.com/1/user/-/apiSubscriptions.json

{ "errors": [ { "errorType": "insufficient_scope", "message": "This application does not have permission to access nutrition data. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process." } ], "success": false }

What I expected to happen:

I believe this nutrition error is unrelated, and a call to the active apiSubscriptions should list subscriptions to sleep / activity if present, regardless of scope permission of nutrition.

[JohnFitbit]

Hi @Alegis,

Welcome to the forums!

Have you checked to see if the user you are pulling data from has consented to the appropriate scopes during the authorization page? Also, verify that your authorization header is set to "Bearer". 

Documentation: 403 Forbidden

[Alegis]

Hi John,

Thanks for replying! I can confirm the bearer was provided successfully and the user provided profile, sleep and activity permissions; but did not provide nutrition

That will cause a call to the general endpoint, get list of active subscriptions, to fail on the aforementioned error.

GET https://api.fitbit.com/1/user/-/apiSubscriptions.json

Is it possible to allow this call to return the apiSubscriptions to which the application does have permission; and not break on the error for an unrelated api subscription?

Kind regards,

[JohnFitbit · Accepted solution]

Hey @Alegis,

Thanks for clarifying the scenario.

I can see that it is unusual for the endpoint to return this message based on one resource that the user did not consent to share when the endpoint is intended to return all active subscriptions for the user, but it appears that this is by design.

However, I will file a ticket for this endpoint to return only collections that the user has consented to share. I'll let you know when I get an update on this enhancement request.

Thanks again for spotting this, let me know if you have any other questions.

[Jpoel]

Hi John, I am too experiencing this issue, and it appears to still be an open problem. Did you get anywhere with implementing a solution?