getting 403 forbidden insufficient scope

[trevor_chong]

hello, this has been happening last few days when trying to sync data from fitbit. Basically for our clients, when running a batch, thousands of our requests have been failing.  Below are the curl request example and error (i tried posting the date.json but the forum says it's not permitted).

curl --location 'https://api.fitbit.com/1/user/-/activities/date/not-permitted-date.json' \
--header 'Authorization: Bearer redacted' \
--header 'Cookie: JSESSIONID=A7FEA7275887F9DDB0AB8B47D509492F.fitbit1; fct=1201bcbe1f464c079568c40281038842'

{
    "errors": [
        {
            "errorType": "insufficient_scope",
            "message": "This application does not have permission to access activity data. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process."
        }
    ],
    "success": false
}

This is suddenly happening and we didn't change anything on our side. Can you please advise?
 

[GordonFitbit]

Hi @trevor_chong 

This error typically means the user did not consent to share that dataset with your application.  In this case, it would be activity.   You can call the introspect endpoint, using their access_token in the parameter value, to see which scope the user consented to share with your application.   Keep in mind when the user completed the authorization flow, we provide your application the list of scopes enabled along with the initial access token and refresh token.   You can store this information to know which endpoints your application can successfully query.

Gordon