Invalid Scope Error when Creating Subscription

[AnthonyValidic]

 We're seeing the following error when making a call to: "/1/user/-/apiSubscriptions/#{sub_id}.json"

This application does not have permission to access weight data. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process.

I'm trying to understand the behavior of this.  If a user does not give us access to the weight collection/resource path, will the above call subscribe us for all the scopes they did grant?  If not, is the recommendation we use the scopes and make individual resource-based subscription calls?

[JeremiahFitbit]

Are you including the "#" symbol unencoded?

[AnthonyValidic]

Sorry no, that is just to show a variable substiution.  The call works successfully when the user has granted us all scopes but fails, like the case above, when weight (or another scope) was not granted.

[JeremiahFitbit]

You're making a subscription request for all activity. If you want to subscribe to a subset, you'll need to specify the resource collection (activities, body, sleep, etc). https://dev.fitbit.com/docs/subscriptions/#adding-a-subscription

[AnthonyValidic]

Sure, I understand that but per my original question - is this subscription failing to register all together or are some of the subscriptions for the collections we do have scopes for being created?

Example, user permits: activities, foods, sleep but not body.  With the above call, will we start recieving subscriptions for those we do have scopes for or none at all?

[AnthonyValidic]

Just want to check in on this @JeremiahFitbit

[AnthonyValidic]

Hi @JeremiahFitbit can we get an update on this issue please.

[AndrewFitbit]

@AnthonyValidic It should still work for the ones that are granted.

[AnthonyValidic]

Hi @AndrewFitbit and @JeremiahFitbit - We've done manual testing on this on our end and can confirm that subscriptions are not being created through this endpoint when any scope has been revoked.  Can you confirm if this is a bug on your end or intended?

Follow up to that, are there a set of mininum scopes necessary for this endpoint to work?

[ShaneFitbit · Accepted solution]

You need the following scopes when creating api subscriptions via POST to /apiSubscriptions/{sub_id}: activity, nutrition, profile, settings, sleep, and weight. Otherwise, you'll get a 403 and no subscriptions will be created for any collectionType. This is intended behavior, because you are creating a subscription that is notified when changes occur to any collection type. If you want to create a subscription for a specific collection type, make sure you have the required scope for that collectionType, and prefix /apiSubscriptions with the collectionType name as outlined here: https://dev.fitbit.com/docs/subscriptions/#adding-a-subscription. Here's a list of collectionTypes and the scopes required for each:

activities - activity

body - weight

foods - nutrition

sleep - sleep

no collectionType listed - activity, nutrition, profile, settings, sleep, weight

Similarly, if you get a list of all subscriptions, you are viewing subscriptions for any collection type. To view subscriptions for a specific collection type, prefix /apiSubscriptions with the collectionType name. For example, "foods/apiSubscriptions".

You have a good point that if you view all subscriptions, you shouldn't need all scopes; you should just be shown subscriptions for which you have scopes. We'll discuss implementing this feature and will keep you updated. In the meantime, use all scopes to view all subscriptions.

We will update the documentation here https://dev.fitbit.com/docs/subscriptions/ with the clarification on scopes required. Thanks for pointing this out."

[dbray]

I am having a similar problem getting access to heart rate data. I have authorized for scope heart-rate (don't want all the other data).  Can't seem to figure out how to set up a subscription to get updated heart-rate data.