Insufficient Permissions Error

[NicBonetto]

Hi,

I am trying to fetch data from 4 endpoints:

/activities/list.json

/[user-id]/body/log/weight/date/[date].json

/[user-id]/foods/log/date/[date].json

/[user-id]/sleep/date/[date].json

Out of those 4, 3 return an "API client is not authorized by the resource owner to access the resource requested" error. The only endpoint I can fetch data from is /activities/list.json. I am using a personal test account to simulate the subscription notifications, and allowed my application to access the following scopes: activity, heart rate, location, nutrition, sleep, weight, and profile. I can successfully subscribe to the foods, activities, sleep, and body streams. And on the Fitbit account I am using for the mock data, I have all my privacy settings set to Public. Not quite sure why it is throwing the insufficient_permissions error. Did I miss anything? I do not have intraday access, could that be the issue?

[NicBonetto]

I have also ensured I am using the correct access tokens for the specific users.

[JohnFitbit]

Hi @NicBonetto,

Can you clarify the following information so that I can determine the issue?

• Is your app set to personal, server, client?
• Are you extracting your own personal data or other users?
• Can you provide me with the full URL of the endpoints you are querying?

Also, can you PM me your client ID as well?

Hope to hear from you soon!

[NicBonetto]

Hey @JohnFitbit thanks for the quick reply. To answer your questions:

- My app is set to server for OAuth.

- Right now, I am extracting my personal data to test, but will be pulling other's in production.

- https://api.fitbit.com/1.2/user/-/activities/list.json

- https://api.fitbit.com/1.2/user/[user-id]/body/weight/log/date/[date].json

- https://api.fitbit.com/1.2/user/[user-id]/foods/log/date/[date].json

- https://api.fitbit.com/1.2/user/[user-id]/sleep/log/date/[date].json

I messaged you my Client ID.

[JohnFitbit]

@NicBonetto Thanks for providing me with that information.

Since you are using 'server', did you ensure that you enabled all scopes when consenting your application to access your data? If you are unsure, revoke access to your application and go through the authorization process again.

Also, since you said you that you are only extracting your own personal data at this time, I recommend switching your application type to 'personal' as this classification automatically grants immediate access to the intraday time series to the owner of the app.

You can reclassify your application as a personal app by going to your app settings at https://dev.fitbit.com/apps. For the "OAuth 2.0 Application Type" setting, check "Personal App".

When you need to start extracting other user's data, then you can switch your app back to either 'server' or 'client'.

If you are still seeing the error, please let me know and I'll be happy to investigate further.

[NicBonetto]

@JohnFitbitthanks for all the help. I found the issue. I was sending the subscriptionId instead of the ownerId in the URLs. Sorry for the inconvenience.

[voliotDev]

Hi @NicBonetto ,

I am facing same issues and I have authorized the user with my application and currently I am trying to access my personal data only. I am only ables to access user profile data i.e., 

https://api.fitbit.com/1/user/-/profile.json

 I am not able to access following APIs for example:

https://api.fitbit.com/1.2/user/-/sleep/list.json?sort=asc&offset=0&limit=100
https://api.fitbit.com/1/user/-/activities/date/2021-10-19.json
https://api.fitbit.com/1/user/-/activities.json

Can @JohnFitbit and @NicBonetto   you help me here? 

[Gordon-C]

Hi @voliotDev 

The access permissions to the user data is defined by the access token.  It's possible the access token you're using is not the one you believe has all of the permissions enabled.   The tokens are JWT tokens, so you should be able to look at the token to see what permissions were enabled.   Otherwise, I'd recommend for you to go through the authorization process again and obtain a new access token with all of the permissions enabled.   

If that doesn't work, please let us know.

Gordon

[user1995]

Hi,

I am trying to use the below api and its giving me error "Insufficient Permissions" while I am able to access profile api "user/-/profile.json". 

https://api.fitbit.com/1/user/-/activities/{resource-path}/date/{date}/{end-date}/{detail-level}/time/{start-time}/{end-time}.json

[user1995]

Also i am able to access this api as well 

1/user/-/activities/date/2021-10-19.json

 I want to access the steps count, calories burnt and distance covered of past or of a particular date for this I am using api 

https://api.fitbit.com/1/user/-/activities/{resource-path}/date/{date}/{end-date}/{detail-level}/time/{start-time}/{end-time}.json

but this gives me error of "Insufficient Permissions". 

My app is set to "Client". And I am trying to access the other user's data. 

[voliotDev]

Hi @user1995 ,

1. Did you check the user you authenticated to use the application and the user for which you are trying to access data are same ? 

2. Check for the permissions user provides to the application while entering credentials to log In.

This might be useful.

[user1995]

@voliotDev ,Yes, I checked the user authentication and i have given all the permissions(permission to access the scopes like "steps","sleep","calories" etc.) I am using the same access token for all apis (apis mentioned below).

1. https://api.fitbit.com/1/user/-/activities/date/2021-10-19.json

2. https://api.fitbit.com/1/user/-/profile.json

3. https://api.fitbit.com/1/user/-/activities/{resource-path}/date/{base-date}/{end-date}.json

4. https://api.fitbit.com/1/user/-/activities/{resource-path}/date/{date}/{end-date}/{detail-level}/tim...

All are working accept the last one (no 4). Last api is giving me error "Insufficient Permissions".

As the last api belongs to Intraday so I have filled the Intraday form as well but have not gotten any success to fetch the intraday data.
Intraday form - "https://dev.fitbit.com/build/reference/web-api/intraday/"

@voliotDev has your issue been resolved? 

[voliotDev]

Hi @user1995 ,

Yes, my issue got resolved and it was the permission issue only.
Maybe @Gordon-C  and @JohnFitbit  can help!

[user1995]

@voliotDev could you please confirm what do you mean by the permission? Is it the permission screen where we give permission for scopes like  "Activity and exercise " , "Weight", "Location and GPS" , "Sleep" etc. ?

[voliotDev]

Hi @user1995 ,

Yes, it's that screen only.

[user1995]

@voliotDev  Thank you for the confirmation. I am now waiting for the approval of Intraday access. 

[Gordon-C]

Hi @user1995 

The error you're receiving is because you're calling the intraday endpoints using the application type = "client" or "server", and your application doesn't have intraday endpoint.   You are correct you can query your own intraday data, but you need to use the application type = "personal".   The client and server application types allow for querying other user's data.  There are a few options for you,

• Sounds like you requested intraday access.   This would be necessary if you need to query other Fitbit's users data.   Once approved, you can query the intraday data using the application type of client or server.
• If you're only querying your data, change the application type to personal.
• If you don't require intraday data, use the time series endpoints listed at https://dev.fitbit.com/build/reference/web-api/activity-timeseries/.

Gordon

[user1995]

Thank you @Gordon-C for the response. Yes, i am trying to access other user's data where my application type is "Client". I have requested for the intraday access. Approval awaited.