# Insufficient Scope Error **URL:** \ **Category:** Questions\ **Tags:** oauth-api\ **Created:** [December 7, 2020, 4:46am UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374 "2020-12-07T04:46:06Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![sanaa.khan](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@sanaa.khan](https://developer.squareup.com/forums/u/sanaa.khan)\ **Post date:** [December 7, 2020, 4:46am UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/1 "2020-12-07T04:46:06Z")
I started seeing this today, while everything was working fine about 2 weeks back. I’m receiving the below error when trying to run a query using API Explorer. ```auto { "errors": [ { "code": "INSUFFICIENT_SCOPES", "detail": "The merchant has not given your application sufficient permissions to do that. The merchant must authorize your application for the following scopes: [ORDERS_READ]", "category": "AUTHENTICATION_ERROR" } ] } ``` ---
**Author:** ![sjosey](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/sjosey/32/40_2.png) [@sjosey](https://developer.squareup.com/forums/u/sjosey)\ **Post date:** [December 7, 2020, 5:45pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/2 "2020-12-07T17:45:43Z")
Can you share your application id? What endpoint are you hitting when you receive this error? ---
**Author:** ![sanaa.khan](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@sanaa.khan](https://developer.squareup.com/forums/u/sanaa.khan)\ **Post date:** [December 7, 2020, 9:03pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/3 "2020-12-07T21:03:42Z")
App Id: sq0idp-LXyFOXjv\_dK-4GfvXPdVQQ Orders - Batch Retrieve ---
**Author:** ![sanaa.khan](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@sanaa.khan](https://developer.squareup.com/forums/u/sanaa.khan)\ **Post date:** [December 7, 2020, 10:30pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/4 "2020-12-07T22:30:12Z")
And when I try to access using the API through my code, I’m able to access the Payments, when I try to read the Order using BatchRetrieve Request, I get a message, “Waiting for activation” ---
**Author:** ![sjosey](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/sjosey/32/40_2.png) [@sjosey](https://developer.squareup.com/forums/u/sjosey)\ **Post date:** [December 7, 2020, 11:04pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/5 "2020-12-07T23:04:12Z")
I’m not seeing any order endpoints being hit with that application id. I only see ListPayments being called and a very small amount of ListEmployees. Is it through a different application? ---
**Author:** ![sanaa.khan](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@sanaa.khan](https://developer.squareup.com/forums/u/sanaa.khan)\ **Post date:** [December 7, 2020, 11:55pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/6 "2020-12-07T23:55:26Z")
Oops. I don’t think so. I’m calling the ListPayments from the same program and App Id. ---
**Author:** ![sjosey](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/sjosey/32/40_2.png) [@sjosey](https://developer.squareup.com/forums/u/sjosey)\ **Post date:** [December 8, 2020, 4:58pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/7 "2020-12-08T16:58:44Z")
I’m still not seeing any, hmmm. Is this for a specific `location_id` or `merchant_id`? I can try searching for one of those instead. ---
**Author:** ![sanaa.khan](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@sanaa.khan](https://developer.squareup.com/forums/u/sanaa.khan)\ **Post date:** [December 8, 2020, 5:34pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/8 "2020-12-08T17:34:17Z")
I think we just have one Location Id and Merchant Id. Silly question but how can I know if we have any other Merchant Id? UPDATES: - Is there anything I can try that would help debug this problem? We have to get all our payments into our main system by 12/28/2020. I’m running out of time! - I updated the API Version recently. but that was also in attempt to solve this issue. Stating here in case that helps - Im using C#.net to make the API requests. I updated the library today. - This is the exception Im getting **ApiException: HTTP Response Not OK** ---
**Author:** ![sjosey](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/sjosey/32/40_2.png) [@sjosey](https://developer.squareup.com/forums/u/sjosey)\ **Post date:** [December 9, 2020, 5:16pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/10 "2020-12-09T17:16:21Z")
Apologies for the confusion here, I didn’t realize these errors do not log the application id. I was able to find it using your location id tied to your application. So, looking your access tokens up, I see you’ve created several, I’m guessing through OAuth. Several of them only have `PAYMENTS_READ` permission, so this error is accurate: you need `ORDERS_READ` permission. If you are using OAuth, you need to be sure to include all of the scopes in the OAuth authorization URL. ---
**Author:** ![sanaa.khan](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@sanaa.khan](https://developer.squareup.com/forums/u/sanaa.khan)\ **Post date:** [December 9, 2020, 7:10pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/11 "2020-12-09T19:10:26Z")
No problem. I apologize for getting a little impatient as well. I just refreshed a token using API Explorer adding Payments\_read and Orders\_Read scopes. But Im still getting the same error. ---
**Author:** ![sjosey](https://sea1.discourse-cdn.com/square/forums/user_avatar/developer.squareup.com/sjosey/32/40_2.png) [@sjosey](https://developer.squareup.com/forums/u/sjosey)\ **Post date:** [December 9, 2020, 7:25pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/12 "2020-12-09T19:25:02Z")
That will not work, you cannot add scopes via the API. You must go through the OAuth authorization url again. Refreshing the token will generate a new token with the same permissions. If you passed the `scopes` parameter, that’s only for _reducing_ the scopes, not adding new scopes. ---
**Author:** ![sanaa.khan](https://avatars.discourse-cdn.com/v4/letter/s/bbe5ce/32.png) [@sanaa.khan](https://developer.squareup.com/forums/u/sanaa.khan)\ **Post date:** [December 9, 2020, 8:34pm UTC](https://developer.squareup.com/forums/t/insufficient-scope-error/1374/13 "2020-12-09T20:34:44Z")
That was it! Thank you so much Stephen! I really appreciate your help.