# How to make a petition with a access token?

**URL:** <https://devforum.okta.com/t/how-to-make-a-petition-with-a-access-token/19462>\
**Category:** OAuth/OIDC\
**Tags:** api, oauth\
**Created:** [February 18, 2022, 11:57am UTC](https://devforum.okta.com/t/how-to-make-a-petition-with-a-access-token/19462 "2022-02-18T11:57:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![alvaropf99](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@alvaropf99](https://devforum.okta.com/u/alvaropf99)\
**Post date:** [February 18, 2022, 11:57am UTC](https://devforum.okta.com/t/how-to-make-a-petition-with-a-access-token/19462/1 "2022-02-18T11:57:04Z")

</div>

Hi everyone

I don’t know if I’m doing something wrong but I have created an oauth2 token, and I have given the following scopes:  
okta.clients.read  
okta.users.manage  
okta.users.read

I have the access token, via /token and I have checked that it is correctly activated with introspect.

My question is how to make requests with this api, I am for example making the following request:  
https://{{myorg}}.oktapreview.com/api/v1/users?limit=25

and in the header I have instead of ssws I have Bearer {{accessToken}}

However with postman I can make the request with ssws but I can’t do it with the oauth access token, I get error 400 bad request.

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![shantanu.sardal](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@shantanu.sardal](https://devforum.okta.com/u/shantanu.sardal)\
**Post date:** [February 19, 2022, 5:01am UTC](https://devforum.okta.com/t/how-to-make-a-petition-with-a-access-token/19462/2 "2022-02-19T05:01:53Z")

</div>

Did you grant those scopes to the client app as described here - [Implement OAuth for Okta | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/#define-allowed-scopes)?

Okta silently downscopes the request, which means it returns all the requested scopes in the token, but the token will not work if the endpoint requires that particular scope.

---

<div class="post-metadata">

**Author:** ![alvaropf99](https://avatars.discourse-cdn.com/v4/letter/a/8e8cbc/32.png) [@alvaropf99](https://devforum.okta.com/u/alvaropf99)\
**Post date:** [February 20, 2022, 8:20pm UTC](https://devforum.okta.com/t/how-to-make-a-petition-with-a-access-token/19462/3 "2022-02-20T20:20:14Z")

</div>

> [@shantanu.sardal](#):
>
> Did you grant those scopes to the client app as described here - [Implement OAuth for Okta | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/#define-allowed-scopes)?
> 
> Okta silently downscopes the request, which means it returns all the requested scopes in the token, but the token will not work if the endpoint requires that particular scope.

I tested it again with this, but i am sill geting the same error

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 23, 2022, 4:02pm UTC](https://devforum.okta.com/t/how-to-make-a-petition-with-a-access-token/19462/4 "2022-02-23T16:02:10Z")

</div>

What are the admin permissions for the user making the request? Remember that any resource that requires an admin API token be used to access it (like listing all users) will also have the same admin permission requirement if using an OAuth token to authorize the requst.

If you log in as a super admin, does the request work?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 8, 2024, 9:35pm UTC](https://devforum.okta.com/t/how-to-make-a-petition-with-a-access-token/19462/5 "2024-02-08T21:35:11Z")

</div>

Closed on February 8, 2024, 9:35pm UTC