Response erroneously reporting that our marketplace app scopes have changed.

Hey @David Zeidman, I've asked Support to forward the bug to our team. I didn't see an App ID in the support conversation I saw, but I did see track down some 403s from two customers associated with one of the apps on your account.

Responding here as it may help others running into this.

1) For the customer seeing your scope error: the root cause is that this customer doesn't have Raiser's Edge NXT in this environment, so they are unable to grant the access your app is asking for. This is also why their Marketplace Manage page doesn't indicate that they have any scopes to approve—they can't. I have a feeling that this customer simply connected your application to the wrong environment.

When this customer connected your application, they would have been presented with this message on their Connect screen.

We can likely improve the user and developer experience here. We still allow the customer to connect an application in this state, which we might want to reconsider. I'll pass this along to the team.

2) The second customer's issue does appear to be related to permissions. The authorizing user is a Legal Entity admin, but they are not a Product/Solution admin. Once I get the bug, I'll pass this along to the Raiser's Edge team to confirm.

@Nick Marchese, make sure that the customer's Marketplace Admin visits the Marketplace's Manage page after you change your app's scopes. We require customers to be in the loop when an application requests changes to what they can access. If the customer doesn't see changes to approve (like in David's case), it might mean that they don't have BEM. Side note: While the API response does indicate which scopes the customer has granted, you can also confirm what Access/Scopes that a customer has approved by looking at your application's [View Environments] page.

I see. You're right, scope changes immediately take effect in the SKY Developer Cohort. The only remaining piece is the access token itself. Scope access is tied to the access token issued to your application. You can see your token's issued scopes in the OAuth 2.0 Token endpoint response (scope property). If your access token was issued before your scope change, then your application will need to obtain a new access token to acquire updated access. Just to be clear, the user doesn't need to re-authorize your application. New access tokens issued by refresh token exchanges will also have updated access. If that's not what you're seeing, you'll need to file a ticket so we can investigate.

@David Zeidman We resolved this error on my end because for some reason the application ID got mixed up, even though it was consistently working prior to that. Not sure if you resolved this or not, but wanted to circle back.