I’m using HubSpot Service Keys for server-to-server authentication in a Python-based data ingestion pipeline. The pipeline calls HubSpot CRM APIs and loads the results into my datawarehouse.
When calling GET /crm/v3/owners?limit=100, the API returns 403 Forbidden with category MISSING_SCOPES.
The error says the request requires one or more of these scopes:
crm.objects.owners.read
automation
crm.pipelines.governance.write
crm.pipelines.approval.read
My understanding is that listing CRM owners should require crm.objects.owners.read. The other three scopes seem unrelated to this read-only request.
Troubleshooting completed:
Verified the Service Key configuration and required owner-read scope.
Tested the endpoint directly using Python requests, outside the ingestion framework.
The request still fails with the same missing-scopes error.
This appears to be an authorization or scope-validation issue rather than a problem in the ingestion framework.
Questions:
Why does the owners endpoint report requirements for automation and pipeline governance/approval scopes?
Is this expected behavior for Service Keys, or is there a known issue with scope validation on this endpoint?
Is there a recommended workaround that doesn’t require granting unrelated or write-level permissions?
Welcome to the Community and thanks for detailed post!
Since you’ve already tested outside your pipeline, I could be worth to double-check that the owners read scope is saved on the exact Service Key you’re calling with, and that an older key isn’t still sitting in an env variable or secrets store. The Service Keys docs are also worth a look for how scopes are checked on this endpoint.
Tagging in some folks from the community who may have some more experience in this area!
Hey @vsrivmf, they’re not extra requirements. The Owners endpoint accepts any one of those 4 scopes, and the error just prints the full list. crm.objects.owners.read alone is enough, so you don’t need automation or anything write-level.
On whether it’s expected: no. If the key really has owners read, the call should go through. Service Keys are still in public beta, and a key can only hold scopes the person who created it has. So if the creator doesn’t have owner access, the scope may not have actually saved, even if it looks selected.
For a fix, open the key, click View logs, and check that your 403 calls actually show up there. If they don’t, the pipeline is sending a different key or a key from another portal. If they do, have a super admin re-add owners read on the key, click Update, and try again.
Hey! I actually had this exact error last week! I only added crm.objects.owners.read and it worked!
The error lists four scopes, but the endpoint only needs any one of them. According to the API spec, crm.objects.owners.read on its own should be enough. So the message is a bit misleading, and your key most likely doesn’t have that scope saved. I’d check it in this order:
Go to Development, Keys, Service keys, and click the key’s name
Click Edit, then check that crm.objects.owners.read is in the scope list
If it’s missing, add it, click Update, then save the key
Click View logs on the same page and see if your 403 calls show up there
If they don’t show up, your pipeline is using a different key. Look for an old key in an env variable or secrets store, especially if you’ve rotated it
Only a super admin or someone with the Developer tools permission can edit scopes, so that’s worth checking too. Let me know what the logs show! If you did not create the key, you will need the creator of the key to update the scope
