02-13-2026 03:03 - edited 02-13-2026 03:21
02-13-2026 03:03 - edited 02-13-2026 03:21
Hello everyone,
I am trying to fetch AMZ (Active Zone Minutes) data for getting 2x vigorous and peak data via fitbit API with valid accessToken but I am getting permission denied error.
Application Type : Server
Scopes for getting accessToken: temperature, location, oxygen_saturation, heartrate, sleep, activity, settings, profile, weight, cardio_fitness, nutrition, respiratory_rate, electrocardiogram, social
API URL:
https://api.fitbit.com/1/user/-/activities/active-zone-minutes/date/{startDate}/{endDate}/15min.json
Response:
{
"error": {
"code": 403,
"message": "The caller does not have permission",
"status": "PERMISSION_DENIED"
}
}
While I am getting valid response on :
https://api.fitbit.com/1/user/-/activities/heart/date/{startDate}/{endDate}.json
Please help.
02-20-2026 00:11
02-20-2026 00:11
Hello,
can anyone suggest any solution for this issue
Best Answer02-20-2026 18:47 - edited 02-20-2026 19:04
Fitbit Developers oversee the SDK and API forums. We're here to answer questions about Fitbit developer tools, assist with projects, and make sure your voice is heard by the development team.
02-20-2026 18:47 - edited 02-20-2026 19:04
Hi @jczero2
Thank you for sharing your post! We will check and provide an update as soon as we can.
Best Answer02-27-2026 16:36
Fitbit Developers oversee the SDK and API forums. We're here to answer questions about Fitbit developer tools, assist with projects, and make sure your voice is heard by the development team.
02-27-2026 16:36
Hi @jczero2
The 403 PERMISSION_DENIED error occurs because 15-minute Active Zone Minutes (AZM) data is classified as Intraday Data.
By default, Fitbit blocks "Server" and "Client" application types from accessing high-resolution intraday data. Your Heart Rate request likely succeeded because it was a daily summary, which does not have this restriction.
Solutions:
For Personal/Internal Use: Go to your Fitbit App Settings and change the OAuth 2.0 Application Type from "Server" to "Personal". You must generate a new access token after saving this change.
For Production/Public Use: You must keep the "Server" type and submit an Intraday Access Request form to Fitbit for manual review and approval. Here is the documentaion and you can find the Issue tracker link to sumbit a request: https://dev.fitbit.com/build/reference/web-api/intraday/
"Personal" apps get immediate access to intraday data, but only for the account that owns the app. "Server" apps require explicit permission from Fitbit for these specific endpoints. Hope it helps!
Best Answer