# Required user permission for scope crm.objects.users.read **URL:** \ **Category:** Develop, Build & Integrate\ **Tags:** third-party-apps\ **Created:** [May 7, 2025, 4:09pm UTC](https://community.hubspot.com/t/required-user-permission-for-scope-crm-objects-users-read/131203 "2025-05-07T16:09:41Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![\_Bram](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/_bram/32/28756_2.png) [@\_Bram](https://community.hubspot.com/u/_Bram)\ **Post date:** [May 7, 2025, 4:09pm UTC](https://community.hubspot.com/t/required-user-permission-for-scope-crm-objects-users-read/131203/1 "2025-05-07T16:09:41Z")
I am testing what minimal user permissions are required to authorize API access for my app. It works fine for non super admins when I use the scope crm.objects.contacts.write etc. if I turn on the necessary user permission for standard users. With the scope crm.objects.users.read I keep getting the error that the user doesn’t have the correct permissions during the OAuth flow. Which user permission do I need to turn on for non super users to allow my app access for crm.objects.users.read? ---
**Author:** ![RubenBurdin](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/rubenburdin/32/75212_2.png) [@RubenBurdin](https://community.hubspot.com/u/RubenBurdin)\ **Post date:** [May 7, 2025, 8:14pm UTC](https://community.hubspot.com/t/required-user-permission-for-scope-crm-objects-users-read/131203/2 "2025-05-07T20:14:34Z")
Hi [@\_Bram](https://community.hubspot.com/t5/user/viewprofilepage/user-id/123162) I’ll try to break this down. 1) crm.objects.users.read lets an app hit the **User Details API** , which surfaces every user’s profile and team info; HubSpot treats that as sensitive, so only **Super Admins** (or users that have the full **Add and edit users / Account access** privilege, which is effectively the same in the permission model) can grant it — standard users, even with broad CRM rights, will hit an “insufficient permissions” error during the OAuth screen ([HubSpot Community](https://community.hubspot.com/t5/APIs-Integrations/OAuth-issue-requiring-superadmin/m-p/250649?)). 2) Giving a non‑admin the **Add and edit users** toggle under _Settings › Users & Teams_ promotes them to an admin‑level role and is the only way HubSpot will let that user approve the scope ([HubSpot Knowledge Base](https://knowledge.hubspot.com/user-management/manage-user-permissions?)). 3) There’s no lighter “view‑only users” permission today, so if you want the install flow to work for regular users you have two options: a) drop the scope entirely and use a different endpoint (for example, Owners API) or b) flag it as an **optional scope** in the dev portal; then non‑admins can finish OAuth, but calls to /crm/v3/objects/users will 403 unless the installer was a Super Admin ([HubSpot Developers](https://developers.hubspot.com/blog/enhancing-user-insights-in-public-apps-using-oauth-tokens)). 4) If your app only needs to know _which_ user installed it or to look up the current owner of a record, swap to crm.objects.owners.read (same restriction) or query the OAuth token metadata (/oauth/v1/access-tokens/{token}) instead, which returns the installer’s user and user\_id without extra scopes. 5) Bottom line: to unblock testing, have a Super Admin install the app, or upgrade the tester’s permissions; for production, decide whether you truly need the full users object or can live with lighter data so non‑admin customers can connect without elevating their rights. Hope it helps. ![RubenB_0-1744951380316.png](https://d2qpr2jzcazej7.cloudfront.net/original/2X/a/a3b971f388794f90704ee697c25d92cf1613f49a.png) **[Ruben Burdin](https://www.linkedin.com/in/ruben-burdin/)** **Real-Time Data Sync Between any CRM or Database | Founder @[Stacksync](https://l.stacksync.com/hubspot) (YC W24)** ---
**Author:** ![\_Bram](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/_bram/32/28756_2.png) [@\_Bram](https://community.hubspot.com/u/_Bram)\ **Post date:** [May 11, 2025, 1:58pm UTC](https://community.hubspot.com/t/required-user-permission-for-scope-crm-objects-users-read/131203/3 "2025-05-11T13:58:02Z")
Thank you so much for the explanation. It surely helps to understand. What I want is to read the users email and/or phone numbers. This isn’t present in the owners so I guess your suggestion is probably my best option.