Still receiving subscription notifications for scopes that have been revoked

[drewrawitz]

Hi there,

I'm experiencing a little bit of weirdness, so I wanted to describe my current workflow and see if there are any flaws in it.

1. A user connects with their FitBit account and chooses the permissions, let's say Weight and Sleep.

2. For each permission checked, I add a new subscription by a POST request to that specific collection with a unique subscription ID.

POST https://api.fitbit.com/1/user/-/body/apiSubscriptions/body-123.json
POST https://api.fitbit.com/1/user/-/sleep/apiSubscriptions/sleep-123.json

Now let's say the user re-connects with Fitbit to adjust the permissions, and this time they uncheck Sleep and only want to access Weight.  Is it supposed to automatically remove that `sleep-123.json`  subscription? 

Right now, if that happens, I'm still receiving Sleep notifications even though I revoked access.  If I try to delete that subscription manually, I get this error:

{ "errorType": "insufficient_scope" }

Am I doing something wrong?  Any help is appreciated, thanks!

[JohnFitbit]

Hi @drewrawitz,

Welcome to the forums!

When a user revokes access to an application, the access token is invalidated and you should not receive subscription notifications from this user.

If this is occurring for you, could you please PM me your client ID and the user ID that you are still receiving notifications from? I can check the logs on our end to confirm if this behavior is occurring.

Hope to hear from you soon!