Oauth error received

Developer Support APIs & Integrations
1

I am able to authenticate my private app with my super admin account, but my other user I am getting an error

You do not have permissions to view object type ObjectTypeId{legacyObjectType=TICKET} in portal 342871372 (requires one of [tickets-read, tickets-access]): Forbidden. My app has the “tickets” scope set and i do not see the scopes mentioned in this error as valid scopes. My other user has ticket permissions set and also has APP marketplace access. Any help with this would be appreciated.

2

Hey @TMcDiarmid,

Welcome to the Community!

Something worth looking into with permission-related OAuth errors like this one could be if this is scope mismatch between what the app requests and what’s granted, or a user-level permission that needs adjusting (App Marketplace Access being a common one)

A couple of existing threads that walk through very similar scenarios and may be worth a look while you wait for more input:

Tagging in a few of our Top Contributors who’ve worked through cases like this before and may have additional insight to share

Hey @zach_threadint, @SteveHTM, @Josh -- do you have any suggestions for @TMcDiarmid on this?

Thanks!

Sam, Community Manager

3

Hi @TMcDiarmid :waving_hand:

A similar thread was posted on the HubSpot Developers Slack account (here’s a direct link to the Slack thread -- note, the thread will likely be auto-deleted in the future). The short answer is that (at least as far as I’m aware) there’s no public HubSpot documentation referencing the “tickets-read” or “tickets-access” app permission scopes. My best guess at this stage is that you may have stumbled across some scopes currently undergoing testing or in a beta program, but I’m really not sure.

To quote @Jnix284 from a related HubSpot Developer Slack thread:

“Based on the documentation, the tickets API currently uses a single tickets scope that grants both read and write access — there is no separate read-only scope like tickets.read for tickets. This differs from other CRM objects like contacts, companies, and deals, which have granular scopes (e.g., crm.objects.contacts.read).”

It would be great to get some clarity from HubSpot as to why these errors continue to surface.

4

Yes, according to their docs, “tickets” is the valid scope to use. Which I have in my app, I am able to authenticate with my super admin account. The issue though is when trying to authenticate via a non super admin account. This user has been granted permission "

App Marketplace access" and CRM objects > tickets access is also ON. So I was just wondering if there is some other permission this user needs enabled.
5

Thanks for jumping in to help @zach_threadint and for sharing insights from the Developer Slack.

Adding for context that my response was generated via the Docs Assistant AI on the developer docs website (as disclosed in my slack response).

@TMcDiarmid I also ran your question through the Docs Assistant AI (highly recommend using it for these types of questions), here’s the response that should clarify the error:

**The

tickets-read

and

tickets-access

mentioned in the error are internal user permission names (not OAuth scopes) — your private app scope tickets is correct. The error is about the HubSpot user’s in-app CRM permissions, not the app’s scope.**

A few things to check on the non–super admin user:

  • In their user settings, confirm CRM > Tickets is set to view/edit with access to “All tickets” (not just owned/team tickets).
  • If tickets are assigned to someone else and the user only has “Owned only” or “Team only” access, they’ll hit this error.
  • Verify the ticket’s owner/team matches what the user can access.Confirm the user’s permission set has been fully saved/applied.

Note: for private apps, the access token isn’t tied to a specific user — requests run with the app’s scopes. If the error references a specific user, it’s likely coming from a different auth flow (e.g., a UI extension, user token, or a serverless function using user context).