Removing Existing Scope for a User

[GajulaKranthi]

My application has authorized a user for sleep and heart-rate scope like

https://api.fitbit.com/oauth2/authorize?state=33&redirect_uri=http%3A%2F%2Flocalhost%3A18080&respons...

Now if the user wants to remove the heart-rate scope then all the application needs to do is to re-authorize with this

https://api.fitbit.com/oauth2/authorize?state=66&redirect_uri=http%3A%2F%2Flocalhost%3A18080&respons...

is my understanding correct? I have searched the endpoints but could not find any api that will remove the scope.

[JeremiahFitbit · Accepted solution]

To fully remove a scope, the application authorization should be revoked. The person can do this from their Fitbit settings in the Web app or a client can revoke its own authorization.

A "soft" removal of a scope would involve a person going through the authorization flow with the reduced scope set. Your app will get an access token with only the scopes requested. However, Fitbit still remembers all of the scopes a person has granted an application. If the person were to go through the authorization process a third time with the original, larger list of scopes, the app would receive an access token with the larger list.

[GajulaKranthi]

Thank you for explaining.