Getting insufficient_scope Error Getting List of Subscriptions for User

[Jeff_New_Ocean]

Hi Fitbit Team!

[FYI - I did read the recommended articles here and here, they both say "Solved" but I don't understand what the solution was.]

I am having a similar issue, I have a test user who has granted authorization for scopes

• activity
• weight
• nutrition
• sleep

I was able to successfully create subscriptions for the user for

• activities
• body
• foods
• sleep

However, when I make the request to get all subscriptions for the user

GET https://api.fitbit.com/1/user/-/apiSubscriptions.json 

With their bearer token, it gives me an error

{
    "errors": [
        {
            "errorType": "insufficient_scope",
            "message": "This application does not have permission to access profile, settings data. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
        }
    ],
    "success": false
}

As if the user has to have given access to all scopes in order to show which subscriptions they have.

On one of the other tickets it was mentioned that a ticket was put in to the DEV team, is it still in progress?

The other suggestions don't make sense to me.

• I don't want to demand that users give access to all scopes, as this is at their discretion.
• I don't want to call the GET subscription endpoint for every scope type; this defeats the purpose of the GET all subscriptions request.

Thanks for any info or update!

Jeff Humphry

[Gordon-C]

Hi @Jeff_New_Ocean 

In order to create a subscription for all collections using the syntax you posted, the user needs to grant activity, nutrition, weight, sleep AND profile and settings.   This is described in the documentation at https://dev.fitbit.com/build/reference/web-api/subscriptions/#adding-a-subscription.

Gordon

[Jeff_New_Ocean]

Thanks @Gordon-C,

I did see that note in the instructions, but that is under the create (POST) subscription, which makes sense, because by not specifying the scope, you are defaulting to all scopes.

In my case, I'm trying to GET the list of subscriptions that I created for the user. I would assume that if I created the following: (subscription Ids are contrived)

• POST /1/user/-/activities/apiSubscriptions/ACT.json
• POST /1/user/-/sleep/apiSubscriptions/SLP.json
• POST /1/user/-/foods/apiSubscriptions/NUT.json
• POST /1/body/-/activities/apiSubscriptions/WGT.json

Then when I call the endpoint to get the user's subscriptions

• GET /1/user/-/apiSubscriptions.json

That it would tell me all the subscriptions that the user has, e.g.

{
    "apiSubscriptions": [
        {
            "collectionType": "activities",
            "ownerId": "3ZM4ZR",
            "ownerType": "user",
            "subscriberId": "DEF",
            "subscriptionId": "ACT"
        },
        {
            "collectionType": "sleep",
            "ownerId": "3ZM4ZR",
            "ownerType": "user",
            "subscriberId": "DEF",
            "subscriptionId": "SLP"
        },
         {
            "collectionType": "foods",
            "ownerId": "3ZM4ZR",
            "ownerType": "user",
            "subscriberId": "DEF",
            "subscriptionId": "NUT"
        },
        {
            "collectionType": "body",
            "ownerId": "3ZM4ZR",
            "ownerType": "user",
            "subscriberId": "DEF",
            "subscriptionId": "WGT"
        }
    ]
}

But it's failing saying I need profile scope. - Which isn't a scope that I wanted to subscribe for, so I didn't configure my application for it.

Otherwise you would be saying that unless I configure my application for all scopes, even if I didn't intend to use them all, then I can't get a list of subscriptions for a user.

Maybe I have a conceptual misunderstanding here?

Thanks,

Jeff Humphry

[Gordon-C · Accepted solution]

Hi @Jeff_New_Ocean 

You need to have all 6 scopes I described earlier  to POST, GET or DELETE a subscription without specifying a collection.   I will create a ticket to clarify the functionality in the documentation.