Account activity API (All events - Beta) 401 adding new subscription

[Porschiey]

Hi there,

I’m able to create and delete a webhook for my app and also add a subscription for the user that owns the app. However, when i try to add a second subscription for a second user, I continually get 401.

• I’ve validated the OAuth Access Key/Secret are correct because I can use the very same keys and perform other Twitter commands.
• The app itself is set to get keys for Read, Write, and DMs and was configured this way before I retrieved the OAuth tokens.

Why can I only add one user - the user that owns the app? Let me know what details you might need…

[LeBraat]

Hello @Porschiey,

What method are you using to add these subscriptions?

I would assume the POST account_activity/all/:env_name/subscriptions endpoint, but want to be sure.

You might want to try our Account Activity API dashboard if you continue to have issues:

twitterdev/account-activity-dashboard

[Porschiey]

Yeah, I’m using that endpoint. As I mentioned, it only seems to work with one user - the user who owns the app registration. I’ll check out the dashboard - but - I’ll need my software to be able to automatically manage the user subscriptions at release - so it’s definitely not a long term solution.

[andypiper]

I’m able to add multiple account subscriptions using the Account Activity Dashboard sample app, up be aware that the limit in the standard beta period is up to 35 user subscriptions.

[Porschiey]

Hi @andypiper

I’m well aware of the 35 user limit.

Why can I only add one user - the user that owns the app

I’m not trying to add no. 36, I’m trying number no.2. Is there any scenario you can think of where valid tokens will return 401 for this endpoint?

[andypiper]

I am not aware of any such scenario myself, no.

[Porschiey]

Okay - if the account works via the dashboard, I’ll assume there’s something wrong in my side. Baffles me that the same code that adds one account can’t add another. I’ll post back on Monday my results.

[Porschiey]

Hey again @andypiper ,
I’ve got the dashboard setup and I’ve attempted to add a second account through it. I’ve tried three different accounts in total to add as the second subscription on the webhook, and all of them fail with 401, specifically:
“Client application is not permitted to access this user’s webhook subscriptions.” (Code 348).

Code 348 is in documentation, but I’m a bit lost as to why the client doesn’t have access. To me it would seem that the error is given when the OAuth tokens don’t have sufficient perms, but… the dashboard forces an OAuth cycle to get fresh tokens and the application is set to get perms for everything including DMs.

EDIT: Finally got a second account to be added. I had to go into that user and revoke current permissions from the app, and then attempt to re-add them. This is seems like a bug to me. I don’t want to have all of the users of my app manually go in and revoke access to my app just to keep on using it. Is there a place I can file this bug for you?

[andypiper]

As far as I know, when new permissions are added to an app, the user is required to reauthenticate in order to inherit those permissions (any existing user token will retain the older permissions), so this seems to be working as designed. I’ll mention it to the team, but I think you’d be looking at having the OAuth tokens revoked or refreshed regardless.

[Porschiey]

@andypiper - we didn’t add any new permissions. They have always been fully scoped.

Even if we had, the user did re-authenticate (and the dashboard @LeBraat provided forces this flow) and it still didn’t work without having the user de-authorize the app themselves.

[andypiper]

Your app ID was granted access to the Account Activity API which is not visible in the current apps.twitter.com but would (I think) have the same effect as adding new permissions on the consumer key. I could be misunderstanding how this works on our side, however. Your comment that the user reauth’d makes me think I may be missing something else in this situation.

[happycamper]