HTTP 403 on /demographics: "This application has insufficient scope to perform the operation."

Eric Eskildsen
Eric Eskildsen
Sixth Anniversary Kudos 1 Name Dropper Participant
in Education Management APIs

Hi folks - I'm getting an HTTP 403 Forbidden status on the new demographics endpoint. Other endpoints are working fine - orgs, classes, users, etc.

I'm authorizing with two scopes:

The auth documentation says roster.readonly should give permission for demographics.

Any ideas where the issue might be?

Comments

  • Eric Eskildsen
    Eric Eskildsen
    Sixth Anniversary Kudos 1 Name Dropper Participant

    Bump….I see I accidentally posted in SKY API Authorization. This is really for OneRoster.

    Has anyone seen this with the demographics endpoint?

  • Lindsey Rix
    Lindsey Rix Blackbaud Employee
    Tenth Anniversary Kudos 5 Name Dropper Participant

    @Eric Eskildsen I moved your topic to the Education Management APIs forum category. Thanks for letting us know.

  • Todd DeSchuiteneer
    Todd DeSchuiteneer Blackbaud Employee
    Tenth Anniversary Kudos 2 Name Dropper Participant

    Hi @Eric Eskildsen , if you have any issues with endpoints I encourage you to reach out to our support team with the details of the issue so that the team can troubleshoot.

    You can do this here:


    That being said, I did have a chance to test the Demographics endpoint with the OAuth 2.0 authorization method and I am receiving the same results you are. Testing with 1.0 the results return as expected.

    I will go ahead and open a ticket for you regarding this and reach out once I have the issue reported.

  • Eric Eskildsen
    Eric Eskildsen
    Sixth Anniversary Kudos 1 Name Dropper Participant

    @Todd DeSchuiteneer Thanks, Todd. I see that link mentions customers - can I use that as an integrator, too? That would be great to be able to open tickets when issues like this come up, although I understand if support is limited to customers.

  • Eric Eskildsen
    Eric Eskildsen
    Sixth Anniversary Kudos 1 Name Dropper Participant

    For anyone else who may run into this, Todd opened a ticket and sent the solution in the email thread.

    The demographics endpoint needs an extra scope in the request to the /token endpoint during auth:

    https://purl.imsglobal.org/spec/or/v1p1/scope/roster-demographics.readonly

    Adding that scope fixed the issue for me.

    Note: The demographics scope isn't documented yet (see scope documentation). Todd said it should be added soon.

  • Todd DeSchuiteneer
    Todd DeSchuiteneer Blackbaud Employee
    Tenth Anniversary Kudos 2 Name Dropper Participant

    Hi @Eric Eskildsen you do have access to our support at this time. You should be able to chat in to report problems in the future.

Categories