# Okta Workflows OAuth App API scope

**URL:** <https://devforum.okta.com/t/okta-workflows-oauth-app-api-scope/30055>\
**Category:** Questions\
**Created:** [August 15, 2024, 5:48pm UTC](https://devforum.okta.com/t/okta-workflows-oauth-app-api-scope/30055 "2024-08-15T17:48:17Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![iduggan](https://avatars.discourse-cdn.com/v4/letter/i/848f3c/32.png) [@iduggan](https://devforum.okta.com/u/iduggan)\
**Post date:** [August 15, 2024, 5:48pm UTC](https://devforum.okta.com/t/okta-workflows-oauth-app-api-scope/30055/1 "2024-08-15T17:48:17Z")

</div>

I have a question.

My eventual goal with Okta workflows is to allow the Custom API Action call to Okta for reading admin roles of a group and assigning a target group for an admin role. The admin role is USER\_ADMIN and my call to read an admin role of a group is /api/v1/groups/group\_id/roles.

I assigned the okta.groups.read, okta.groups.manage, and okta.roles.read Okta API Scopes to the OAuth Workflows app. I also have already re-authorized. My question is, why am I still getting the 403 forbidden error when trying to read a group? Is there any other combination of scopes that follow the concept of least privilege? Do I need to enable the okta.roles.manage in order to read a groups admin role?

---

<div class="post-metadata">

**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\
**Post date:** [August 15, 2024, 8:02pm UTC](https://devforum.okta.com/t/okta-workflows-oauth-app-api-scope/30055/2 "2024-08-15T20:02:49Z")

</div>

Try authenticating again. Another option is to create a new connection, which usually helps with scope issues.

Also, the 403 scope error usually shows what scope is missing.

---

<div class="post-metadata">

**Author:** ![iduggan](https://avatars.discourse-cdn.com/v4/letter/i/848f3c/32.png) [@iduggan](https://devforum.okta.com/u/iduggan)\
**Post date:** [August 15, 2024, 8:50pm UTC](https://devforum.okta.com/t/okta-workflows-oauth-app-api-scope/30055/3 "2024-08-15T20:50:45Z")

</div>

Thank you for the reply, creating a new connection does help the scope issue. Now that I know this, I will define out all of the necessary scope and then create a new connection as I do not see the scope changing much in the near future.

---

<div class="post-metadata">

**Author:** ![maxkatz](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/maxkatz/32/5624_2.png) [@maxkatz](https://devforum.okta.com/u/maxkatz)\
**Post date:** [August 15, 2024, 9:28pm UTC](https://devforum.okta.com/t/okta-workflows-oauth-app-api-scope/30055/4 "2024-08-15T21:28:14Z")

</div>

Great, glad it’s working!