insufficient_permissions when writing weight

[GabesScript]

I'm writing a python script to collect and write some data to fitbit. I don't have a smart scale so I just want to add my weight daily to fitbit (and also strava and wahoo). I created a "personal" application. And when requesting the tokens, I used 'scope': 'activity heartrate profile sleep weight'. I'm able to read the user data like name etc.

    headers = {
                'Authorization': f'Bearer {fitbit_access_token}',
                'accept': 'application/json'
            }

    # urlDict["user"] = https://api.fitbit.com/1/user/-/profile.json
    response = requests.get(urlDict["user"], headers=headers, timeout=10)

However when I want to write my weight, using this code:

    today = datetime.now().strftime('%Y-%m-%d')
    data = {
        'weight': weight,
        'date': today
    }
    content_length = len(str(data))
    headers = {
                'Authorization': f'Bearer {fitbit_access_token}',
                'accept': 'application/json',
                'content-length': str(content_length)
            }
    response = requests.post(urlDict["set_weight"], data=data, headers=headers, timeout=10)

I receive the following error:

[{'errorType': 'insufficient_permissions', 'message': 'Read-only API client is not authorized to update resources. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process.'}]

What permissions am I missing? Or is it because this is a "personal" application type, that I can't write anything? 

I tried checking the introspect url, but I can't get that to work:

url = 'https://api.fitbit.com/1.1/oauth2/introspect'
    headers = {
                'Authorization': f'Bearer {fitbit_access_token}',
                'Content-Type': 'application/x-www-form-urlencoded'
            }
    data = {
        'Token':f'{fitbit_access_token}'
    }
    response = requests.post(url, data=data, headers=headers, timeout=10)

{'errors': ['RpcInvalidParametersException(errors:[InvalidParameterError(message:Token parameter is missing. Visit https://dev.fitbit.com/docs/oauth2 for more information on the Fitbit Web API authorization process.)], message:Invalid request parameters)']}

[GabesScript]

Solved the introspect part. It should've been lowercase 😞 Although the docs says "Token=" it should be "token=".

But I now get as response: 
```'scope': '{PROFILE=READ, WEIGHT=READ, HEARTRATE=READ, SLEEP=READ, ACTIVITY=READ}'```
How can I request write permissions?

[jl__ · Accepted solution]

It's in the same place where you select the OAuth application type (client/server/personal). Go to https://dev.fitbit.com/apps -> select your app -> edit application settings -> Default Access Type -> Read & Write

[GabesScript]

Aaaah thank you. I thought I needed the scopes for that. It now works!

[Gordon-C]

@jl__ ...thank you for helping out.

Hi @GabesScript ... would you please point where in the documentation that the introspect endpoint uses a capital T for the token variable?   I'm looking at our documentation and we have it lower case.   If there is a typo, I would like to correct it.

[GabesScript]

Hi,
I can't find it anymore and I think I was looking at the link you're referring to. I guess while trying many different formats to get my python code working I mixed up the instructions, but the link seems with correct caps. Sorry for that.

And thank you for reaching out in your effort to get the documentation quality high. Wish more companies would do that 🙂

Again, sorry for the mistake.

[FosterWest]

I had the same issue with insufficient permissions when trying to write weight data. After some trial and error, I found that it's often a problem with the app permissions or a mismatch in API setup. Double-check that your API is set up correctly, and that all permissions are granted for the specific endpoints you're accessing. If you're working on multiple projects like health apps, you might find some tasks overwhelming. That's why I've been using services like https://www.masterpapers.com/ to help with documentation when I'm short on time. It’s a game-changer, especially when you need to focus on coding or API troubleshooting.