So I'm trying to [fetch invoices][1] on behalf of a customer who has logged in with [Paypal Oauth2][2].
When I try with curl with a valid token
curl -v -X GET https://api-m.paypal.com/v2/invoicing/invoices\?total_required\=true \
-H 'Authorization: Bearer <ACCESS_TOKEN>' \
-H 'Content-Type: application/json'
I get permission denied
{"localizedMessage":"No permission for the requested operation. ","suppressed":[],"name":"PERMISSION_DENIED","message":"No permission for the requested operation. ","details":[{"field":null,"value":null,"location":null,"issue":"No permission for the requested operation. ","description":null}],"information_link":"https://developer.paypal.com/docs/classic/products/permissions/","debug_id":"3b3e0813dca9f"}%
Which makes sense since I don't have the permission in the response object which contains the token
{
"scope": "https://uri.paypal.com/services/checkout/one-click-with-merchant-issued-token https://uri.paypal.com/services/payments/realtimepayment https://uri.paypal.com/services/payments/payment/authcapture openid profile https://uri.paypal.com/services/payments/refund https://api.paypal.com/v1/vault/credit-card https://uri.paypal.com/services/reporting/search/read https://api.paypal.com/v1/vault/credit-card/.* https://uri.paypal.com/services/subscriptions https://uri.paypal.com/services/applications/webhooks https://uri.paypal.com/services/paypalattributes email",
"access_token": "MY_ACCESS_TOKEN",
"token_type": "Bearer",
"expires_in": 28800,
"refresh_token": "MY_REFRESH_TOKEN",
"nonce": "2023-09-08T19:49:05abcdefghijklmn",
"state": "some-state"
}
Which makes me wonder why since I have tried every combination of the invoice scope when before I begin the Oauth process, here they are:
let SCOPES:string[] = [
...
"https://uri.paypal.com/services/invoicing/invoices/readwrite",
"https://uri.paypal.com/services/invoicing/invoices/read",
"https://uri.paypal.com/services/invoicing",
"https://uri.paypal.com/services/.*",
"https://uri.paypal.com/v2/invoicing/invoices",
"https://uri.paypal.com/v2/invoicing/invoices/.*",
...
]
What am I missing here? Where can I even find all the scopes available that are up to date, everything I have found online seems to be wrong
