Unable to delete subscription without access token

[BarriePf]

Hi,

Is there any way I can remove a subscription to my server without having a users access-token?

I don't really see why I should need their permission to do this...

I've got a server with a few users registered.  One user has de-registered, but their subscription wasn't deleted.

I assumed I wouldn't need their access token to delete a subscription to my server... but having removed the authorization header ( baring in mind I no longer have a token for them ), I'm getting this error :

{"errorType":"invalid_client","message":"Invalid authorization header format. Visit https://dev.fitbit.com/docs/auth2 for more information on the Fitbit Web API authorization process."}],"success":false}

Which perhaps implies that I do need their permission to delete a their subscription to my server...

Thanks for any help!

Barrie.

 Moderator edit: Subject line updated

[JeremiahFitbit · Accepted solution]

Fitbit plans to make Subscriptions API management available as a client-only request, but this feature is not yet available.

Please contact private support with your client id, the user id, and the subscription name that you would like to remove.

[BarriePf]

Thanks for the quick reply.

[JordanDev]

Has this been implemented? And if so does this mean I can only delete 150 subscriptions an hour?

Additionally - if an access token is revoked (https://dev.fitbit.com/docs/oauth2/#revoking-access-tokens) will that automatically delete subscriptions as well?

Thanks!

[JeremiahFitbit]

This feature has not been implemented.

It will be rate limited according to the client-only rate limit.

If a person revokes access to an app (or if the app revokes its own authorization from a person), the subscriptions are deleted.

[qwerty123abc]

Hi  @JeremiahFitbit, I've logged a ticket (16643078) as you suggested two three weeks ago and haven't heard anything back from support (actually I received an email a few days ago saying it was closed as a "Duplicate" with no further info even though it isn't resolved and isn't a duplicate - when I contacted online support today they created a new help desk ticket (11722815) to escalate the original ticket - still waiting to hear about any of them).

If you implement the feature (either client or server side) then I won't have to bother your help desk - any idea when this feature is estimated to be implemented?

Thanks in advance.

[RoxanaF]

I am facing the same problem. we have a handful (4) of members we are trying to delete the subscriptions for as they cannot pair their Fitbit accounts to ours due to Conflict errors. I created a help desk ticket over a month ago - no resolution whatsover. @JeremiahFitbit, any chance an edpoint will be available for us to delete subscritions at the application level. As an application, we should be able to delete subscriptions without having a member's token. If we don't need the notifications or don't want access to the data anymore, as an app why can't we be able to remove it? 

[JeremiahFitbit]

---

@RoxanaF wrote:

I am facing the same problem. we have a handful (4) of members we are trying to delete the subscriptions for as they cannot pair their Fitbit accounts to ours due to Conflict errors.

---

This conflict is an issue internal to your application that you will need to address. If you get a duplicate error response code when creating a subscription, you can interpret that as a success assuming your subscription naming convention hasn't changed because the effective result (your app gets notifications for that user) is the same. Also, if you now have a valid access token for the user again, you can list and delete their previous subscriptions.

---

@RoxanaF wrote:

 If we don't need the notifications or don't want access to the data anymore, as an app why can't we be able to remove it? 

---

I agree that this should be a feature and it is still a planned feature, but we have not been able to implement it yet.

[mattwltr]

---

I agree that this should be a feature and it is still a planned feature, but we have not been able to implement it yet.

---

It's been a year. Any news on this topic? @JeremiahFitbit

[SatyaRanjan]

Seriously No solution to this topic yet from a company like Fitbit?

[Gordon-C]

Hi everyone,

Thank you for your feedback on this request.  The functionality is not available at the moment, but I'm current tracking interest.  I've added your names to the open enhancement request.

[bpanne]

Really interested in this feature. I have delete access tokens in my application, but still receive subscriptions.

It would be great if we could delete the subscriptions also using our ClientIdClientSecret in the header. Currently this is not working:

-----

REST call to stop subscription failed.

UserId: null
AccessToken: null
DeleteURI: https://api.fitbit.com/1/user/7FNZ4L/apiSubscriptions/Cx8w0koE.json

NOTIFICATION
Date: 2020-03-30
OwnerId: 7FNZ4L
SubscriptionId: Cx8w0koE

{"errors":[{"errorType":"insufficient_permissions","message":"API client is not authorized by the resource owner to access the resource requested. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."}],"success":false}
403: Forbidden
at Admin.ACT_FitbitNotificationGetData (CallRest : 'Call REST (DELETE)')
at Admin.ACT_FitbitNotificationsGetData.nested.e0dcedde-c415-4530-995b-d095f7af4b96 [0 of 1] (SubMicroflow : 'ACT_FitbitNotificationGetData')
at Admin.ACT_FitbitNotificationsGetData (NestedLoopedMicroflow : '')

[Gordon-C]

Hi @bpanne 

Thank you for your feedback.  I'll add your name to the enhancement.  

One thing to note, the error "insufficient_permissions" typically means the user didn't consent to the dataset with the subscription API endpoint that you're executing.   So, your access token is valid.   If the access token was invalid, you would have received an "invalid access token" error.

[Alegis]

Please add this feature. There's no way to reduce notifications (and thus reduce load on both the 3rd Party and fitbit's own systems) when the access token is no longer valid. This can be the case when users remove their accounts.

[sambheadup]

Hi @Gordon-C 

Has this been implemented yet? I would also like to be notified when the enhancement becomes available.

Thanks,

Sam