<turbo-stream action="update" target="wiki_card"><template>

<h1>HubSpot Error: 403 Forbidden Missing Scopes</h1>
<div class="trix-content"><p>A transfer to HubSpot can fail with a 403 and a <code>MISSING_SCOPES</code> error even when the operation and data are otherwise correct. This can mean either that our app truly lacks the scope, or that the authorizing HubSpot user doesn't have the right permission level for that object - the error looks identical either way. This article shows how to tell the two apart and resolve each.</p><h2>Example</h2><p><strong>Connection:</strong> HUBSPOT001</p><p><strong>Data sent:</strong></p><p>json</p><pre class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><code>{ "inputs": [{ "id": "25669941041", "properties": { "bc_item_no": "ITEM0071" } }] }</code></pre><p><strong>Status code:</strong> <code>403 Forbidden</code></p><p><strong>Response body:</strong></p><pre class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><code>{<br>&nbsp; "status": "error",<br>&nbsp; "message": "This app hasn't been granted all required scopes to make this call...",<br>&nbsp; "errors": [<br>&nbsp; &nbsp; { "message": "One or more of the following scopes are required.",<br>&nbsp; &nbsp; &nbsp; "context": { "requiredGranularScopes": ["e-commerce", "crm.objects.products.write"] } }<br>&nbsp; ],<br>&nbsp; "category": "MISSING_SCOPES"<br>}</code></pre><h2>What to check first</h2><p>Look at the object named in <code>requiredGranularScopes</code> (here: Products) and check whether it's part of our standard supported objects list.</p><h3>Case 1 - Object is already in our supported list</h3><p>The app has the scope - Check this <a href="/wiki/supported_hubspot_objects" data-turbo="true" data-turbo-stream="true" data-controller="wiki" data-action="wiki#updateUrl">Supported HubSpot Objects</a> page for more information. This is a <strong>user permission issue</strong>: the HubSpot user who authorized the connection most likely has <strong>read-only</strong> access to that object, not write.</p><p><strong>Fix:</strong></p><ol><li>Ask the customer's HubSpot admin to check the authorizing user's permissions for that object.</li><li>Grant write access (not just read) if that's what's missing.</li><li>Re-authorize the connection so the change takes effect.</li><li>Re-run the transfer.</li></ol><h3>Case 2 - Object is NOT in our supported list</h3><p>The app itself doesn't have the scope at all.</p><p><strong>Fix:</strong></p><ol><li>Confirm the authorizing user already has access to that object in HubSpot.</li><li>If yes, reach out to Rapidi to add the missing scope(s) to the app.</li><li>Once added, re-authorize the connection and re-run the transfer.</li></ol><p><br></p></div>
</template></turbo-stream>

