PATCH /crm/v3/objects/contacts started returning 403 "CRM_ACCESS or CONTACTS_READ"

Develop, Build & Integrate
1

Hi all,

We have a marketplace app (OAuth, portal-level, isUserLevel: false) that creates contacts and writes timeline events. Its granted scopes are: (crm.objects.contacts.write, timeline, oauth)
No contacts read scope, and it has never had one.

What changed

Until 2026-08-07, PATCH /crm/v3/objects/contacts/{email}?idProperty=email succeeded with those scopes. We have 556 successful updates across 20 connected accounts going back to November 2025.

Screenshot 2026-08-18 at 9.35.34 AM

From 2026-08-12 onward, the identical call returns 403:
{
“status”: “error”,
“message”: “Property validation failed. Required scopes: CRM_ACCESS or CONTACTS_READ”,
“category”: “FORBIDDEN”
}

with no change on our side. No deployments, no app configuration changes, no scope changes, and no code touching this path since June 3.

What the docs say

Both per-operation reference pages for updating a contact list only crm.objects.contacts.write:

Questions

  1. Was a read scope requirement added to contact update paths on or around Aug 12, 2026? If so, where was it announced?
  2. Is this intended behavior or a regression? The error text references the legacy scope names CRM_ACCESS and CONTACTS_READ rather than the granular crm.objects.contacts.* names, which made me wonder whether an older internal check is being applied.
  3. If read is now genuinely required, will the reference docs be corrected?
  4. When a required scope is added to an existing marketplace app, do current installs receive it on the next token refresh, or does every portal have to re-authorize? This determines whether we need to ask 20+ customers to reconnect, so we would rather confirm than guess.
5

Hi @LucasBry,

Welcome to the Community!

Thanks for all the details! We’ve flagged this internally and have a lead on what may be causing it. Before we dig deeper, can you confirm: is your portal opted into the CRM API Write Validation public beta? You can check at App Marketplace Settings > Product Updates (or directly via the link above)

If the portal is enrolled in the beta, that would explain the 403, and would help us confirm whether this is expected beta behavior or something broader. Once we know, we can get you clearer guidance on next steps.

Thanks!

Sam, Community Manager

6

Hello @stassey, I checked it out. We’ve only joined one beta, and it’s related to the theme.

Update Products Last updated
Updates to HubSpot’s new theme. Classic theme will be sunset on August 31st. Free (all hubs & tiers)CRM Aug 12, 2026
7

Hey @LucasBry,

Thanks for confirming! Just to be safe, for security reasons I’ve sent you a DM requesting a few more details about your portal. If you could check that out so we can continue there, that would be great!

Looking forward to your response!

Sam, Community Manager

8

Hey @LucasBry,

Thanks for your collaboration on this!

Upon further review with our internal team, they’ve identified the root cause and deployed a fix about an hour ago.

Could you give the PATCH call another try and let us know if you’re still seeing the 403? We want to make sure you’re all set.

Looking forward to your response!

Sam, Community Manager

11

@stassey thank you for your help! It looks like it’s working now.

12

Hey @LucasBry,

Happy to help. Thank you for your collaboration and patience on this!

Hope you have a great rest of your week!!

Sam, Community Manager