I’m testing the CRM Emails API and need to create/read email engagement records using /crm/v3/objects/emails.
The API returns MISSING_SCOPES and references crm.objects.emails.read.
However, when I add crm.objects.emails.read or crm.objects.emails.write to my Developer Platform app, deployment fails with:
The scope crm.objects.emails.write isn't available to this app. If your app needs it, contact HubSpot support to request access.
I’ve also tested a Service Key with sales-email-read, but this does not grant access to /crm/v3/objects/emails.
What is the current process for getting crm.objects.emails.read/write enabled for a Developer Platform app?
Is this a restricted scope that HubSpot needs to enable manually, or is there a different supported scope/authentication method for the CRM Emails API?
Those crm.objects.emails.read / .write scopes exist, but they are still gated. The Developer Platform picker will reject the build for any app that asks for them self-serve. Your config is probably fine; the platform is blocking the scope, not a typo.
What usually works:
Open a HubSpot developer / app support ticket with App ID, distribution type (private vs marketplace), and the exact error string. Ask explicitly to enable crm.objects.emails.read and crm.objects.emails.write on that app. Same request pattern as the gated calls/meetings/notes/tasks engagement scopes.
Do not block the build on the request. Keep shipping without those scopes, and use whatever engagement path you already have approved while you wait.
sales-email-read is a different permission surface. It is for sales email content / logging style access, not a drop-in grant for /crm/v3/objects/emails. Treat a 403 / MISSING_SCOPES there as expected until emails scopes are enabled on the app.
In the ticket, say whether you need create, read, or both, and whether this is a private single-portal app. That speeds the enablement path.
If Support says emails objects are still invite-only for your app type, ask which supported alternative they want for your use case (for example older engagements endpoints you already have scopes for, or logging via a connected inbox path). Paste their reply wording back here if it is still vague; the exact “not available to this app” line is what other builders compare against.
Adding crm.objects.contacts.read/write alongside sales-email-read resolved the issue, and /crm/objects/2026-03/emails is now working successfully.
The MISSING_SCOPES response listing crm.objects.emails.* sent me down the wrong path initially, so hopefully this helps anyone else who runs into the same issue.
For the Get Email API endpoint, the scopes shown in the screenshots are sufficient when using the GET method. However, if you are using the POST API endpoint, you will also need to include the crm.objects.contacts.write scope to successfully authenticate the API request.
I hope this helps you out. Please mark it as Solution Accepted and Like to help another Community member.
This post was created with the assistance of AI tools
And thanks 