Getting InsufficientScope

[majjiku]

Hi  support team,

We are getting fault Name: "Insufficient Scope" at pre flow while calling the actual API after generating the access token.

Could you please let us know why this error happening. We are using SAAS platform.

we have created new app and updated the consumer secret key as per client requirement. We have not updated the consumer id. it is same as what edge generate after creating app. Does this app consumer secret key updating causing this issue. If not what would be the reason to facing this issue?

error message logs:

environment Name: "prod"

error Code: "403"

error Message: "Required scope(s): SEC-OAV2-Post-VerifyAccessToken.scopeSet"

error Reason: "Forbidden"

error State: "PROXY_REQ_FLOW"

error Title: "null"

fault Name: "Insufficient Scope"

flow: "Pre Flow"

"developer App":"*********", "environment Name": "prod", "errorCode":"403", "error Message": "Required scope(s): SEC-OAV2-Post-VerifyAccessToken.scopeSet", "error Reason": "Forbidden", "error State": "PROXY_REQ_FLOW", "error Title": "null", "fault Name":" Insufficient Scope", "flow": "Pre Flow",

@dchiesa1 @krishnakumartce @cladius

Thank you,

M Kumari.

[dchiesa1 · Accepted solution]

"Insufficient scope" suggests that the token itself, when it was generated, was generated with an insufficient scope. 

At the time of VerifyAccessToken, there is something in the policy that is stipulating the scope that must be present on the token.  If the token was generated without that scope, then VerifyAccessToken fails with "insufficient scope". 

The fix for this is to generate the token with the appropriate scope. 

The rotation of credentials should not affect the scope directly. It may be coincidental that you rotated credentials and then saw the scope problem. Or, it could be somewhat directly related, depending on how you generate tokens. 

Not sure this is helpful.

[majjiku]

yes, here in my case the issue resolved by adding create scope in Product.