nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Response erroneously reporting that our marketplace app scopes have changed.

David Zeidman

We require that users of our marketplace app have access to the NXT Extensibility role. At least two orgs have now reported that even though they are admin users they are getting a message from us telling them that they do not have the role.

We make a call to the NXT Data Integration API in order to determine if they have the NXT Extensibility role. In one case the API response was

{"title":"Forbidden","status":403,"detail":"This application has insufficient scope to perform the operation. This application's scopes configuration is either insufficient for the request, the organization's Blackbaud Marketplace admin hasn't yet approved the application's updated access configuration, or the scope can't be granted in this environment because the environment doesn't contain the product capability being requested. Learn more: https://developer.blackbaud.com/skyapi/docs/applications/scopes. Required scope access for this SKY API operation: 'rnxt.r'."}

When we asked them to check the marketplace there was no new scope (we also had not changed the scope).

I have created a case 020843609 if anybody here from Blackbaud cares to weigh in that would be great.

I appreciate that this is a difficult one as it is not generally repeatable (at least by us). I have the user's permission to supply their details in order to repeat the error.

Find more posts tagged with

Accepted answers

All comments

Nick Marchese

Hey hey. Such a coincidence. I'm actually experiencing a very similar issue but with the Education Core endpoints. This just started for me as well. Haven't opened a ticket yet. I tried to update the scope as well but to no avail.

Chris Rodgers

Hey @David Zeidman, I've asked Support to forward the bug to our team. I didn't see an App ID in the support conversation I saw, but I did see track down some 403s from two customers associated with one of the apps on your account.

Responding here as it may help others running into this.

1) For the customer seeing your scope error: the root cause is that this customer doesn't have Raiser's Edge NXT in this environment, so they are unable to grant the access your app is asking for. This is also why their Marketplace Manage page doesn't indicate that they have any scopes to approve—they can't. I have a feeling that this customer simply connected your application to the wrong environment.

When this customer connected your application, they would have been presented with this message on their Connect screen.

We can likely improve the user and developer experience here. We still allow the customer to connect an application in this state, which we might want to reconsider. I'll pass this along to the team.

2) The second customer's issue does appear to be related to permissions. The authorizing user is a Legal Entity admin, but they are not a Product/Solution admin. Once I get the bug, I'll pass this along to the Raiser's Edge team to confirm.

@Nick Marchese, make sure that the customer's Marketplace Admin visits the Marketplace's Manage page after you change your app's scopes. We require customers to be in the loop when an application requests changes to what they can access. If the customer doesn't see changes to approve (like in David's case), it might mean that they don't have BEM. Side note: While the API response does indicate which scopes the customer has granted, you can also confirm what Access/Scopes that a customer has approved by looking at your application's [View Environments] page.

Nick Marchese

Hey there. My example is actually in a Developer Cohort account, so there is no place to approve the scope change. Can you confirm how to proceed?

Chris Rodgers

https://community.blackbaud.com/discussion/comment/313073#Comment_313073

I see. You're right, scope changes immediately take effect in the SKY Developer Cohort. The only remaining piece is the access token itself. Scope access is tied to the access token issued to your application. You can see your token's issued scopes in the OAuth 2.0 Token endpoint response (scope property). If your access token was issued before your scope change, then your application will need to obtain a new access token to acquire updated access. Just to be clear, the user doesn't need to re-authorize your application. New access tokens issued by refresh token exchanges will also have updated access. If that's not what you're seeing, you'll need to file a ticket so we can investigate.

Nick Marchese

Hey there. Understood. Thanks. I have obtained a new token, I believe, but the issue remains. I can't get through to support via Chat Central, so I'll email the SKY team and hope for the best!

Nick Marchese

@David Zeidman We resolved this error on my end because for some reason the application ID got mixed up, even though it was consistently working prior to that. Not sure if you resolved this or not, but wanted to circle back.

David Zeidman

@Nick Marchese Thanks for the follow up. We resolved it because our client has an education production which they somehow used to set up our app. I am really not sure how that happened to be honest. There are no scopes for education set so that is why it was out of scope. On the other hand, you would think that if there were no scopes set they would not be able to authenticate against it to start with…