This oauth-token (XXX) does not have proper permissions! (requires any of [crm-public-object-api-access])

[clintonskakun]

I'm trying to do a GET https://api.hubapi.com/crm-associations/v1/associations/XXX/HUBSPOT_DEFINED/2

and I get this back 403:
This oauth-token (XXX) does not have proper permissions! (requires any of [crm-public-object-api-access])

We already have contacts scope. Plus there's no issues pulling from contacts or companies.

Not sure what crm-public-object-api-access is. It's not listed under the scopes in the docs.

[clintonskakun]

@Connor_Barley Yes! I can confirm that this works in my tests.

Another question, will existing oAuth keys suddenly have access to this as well, or do they need to re-connect?

[cbarley]

@dedupely, they should work out of the box. Generating a new Access token from my own app originally I was unable to access the endpoint via Oauth. Since the fix, I used the same refresh token and did not reinstall the app and was able to successfully make a request. Since we just added scopes to an already existing scope group this should work for all portals that already have your app installed.

[clintonskakun]

This is way past helpful! Thanks so much for taking care of this so quickly. We're ready to rock and roll now.

[cbarley]

@dedupely sweet!! Glad I was able to help ya out here. Have a great weekend!

[cbarley]

Was just able to make a successful GET request in Postman. This should be all set, @dedupely! Let me know if you encounter issues.

[clintonskakun]

@Connor_Barley Wow, ok, that's good news. I'll wait to hear back from you before touching any more code. Thanks

[clintonskakun]

Hi @Connor_Barley, that would work however I need to get all connected associations for the companies so nothing goes missing on re-assigning. Associations is my only hope. So if I update the scopes to use ecomm and tickets I'll have to ask existing customers to re-login their HubSpot accounts, right? Just so I can plan a scope migration.

[cbarley]

Hi @dedupely, For the scopes issue I think the main issue is that at the moment, CRM Associations cannot fetch contact/company associations with OAuth, so migrating your scopes to tickets/ecomm wouldn't do anything. You'd still need scopes at some point to include contacts. That's on us to fix. Luckily, we have a fix in the works that should be ready by end of day today that should fix the issue your seeing.

[cbarley]

Hi @dedupely, we're continuing to investigate the root cause of the issue, but wanted to provide a potential solution for you here. It seems like you're trying to get contact associations for a company. Have you considered this this endpoint here: https://developers.hubspot.com/docs/methods/companies/get_company_contacts? You could make a GET request to get the contacts associated to a specific company just as you would be able to do with the CRM Associations API.

[clintonskakun]

Thanks! Knowing this will be a big help.

[cbarley]

Hi @dedupely, I'm able to reproduce this behavior in my own portal. Currently, it sounds like we can only create/get associations if you have a tickets or e-comm scope group. The reason that we limited it to those was probably because that was the initial use case. However, I don’t think there’s a reason that we can’t (or shouldn’t) also include scope groups for contacts, deals, etc. I'm going to reach out to my team to see if this is expected behavior or not. Thanks!

[clintonskakun]

Anyone having a similar issue? I'm in need of help on this.