The token has contacts, companies and deals read + write. Creating a contact works. Creating a note, task, call or meeting (POST /crm/objects/2026-09/notes, /tasks, /calls, /meetings) always returns 403 “This app hasn’t been granted all required scopes”.
Docs list notes as supported for user-level apps. What is missing?
This is a free-tools account. Is creating activities with user-level apps limited to paid plans?
Thanks! Update: I checked the CRM object scopes and OAuth scopes references, and nothing notes-specific seems to be missing. Same 403 in a developer test account with paid features enabled (hub 149413157), freshly installed via /oauth/authorize/user with crm.objects.contacts.write granted. So it’s not plan-related. Contact creation works with the same token; only activity objects (notes, tasks, calls, meetings) are refused. Is activity creation actually enabled for user-level apps yet?
That 403 is HubSpot saying the token is missing engagement-object scopes, not that contacts write is broken.
Contact / company / deal read+write cover those CRM objects. They do not reliably authorize create on /crm/objects/.../notes, /tasks, /calls, or /meetings. Your symptom (contact create OK, note/task/call/meeting create 403) matches that split.
Practical path:
In the app auth config, request the granular engagement scopes for what you write: crm.objects.notes.read / .write, and the same pattern for tasks, calls, and meetings if you use those endpoints.
Redeploy / save the app, then fully re-authorize the user-level install (/oauth/authorize/user) so the new token actually carries those scopes. Editing the app without a fresh user consent leaves the old grant in place.
If the app build or install rejects those scopes as “not available to this app,” that is a known gated path right now (see the parallel thread on granular engagement scopes). Open a HubSpot developer support request naming app 54493376 and ask them to enable the engagement scopes on the app, then re-authorize again.
After re-auth, decode or introspect the access token scopes and confirm notes/tasks/calls/meetings are present before retrying POST.
I would not plan around “contacts.write implies notes write” for this platform version. Treat timeline activities as their own permission surface.
If you can share whether the scopes fail at app build time or only at API call time after a clean re-auth, the next step is either “support enablement” or “token still on the old grant.”
