# Failing to call GET /api/v2/device-credentials endpoint

**URL:** <https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213>\
**Category:** Get Help\
**Tags:** refresh-tokens, auth0\
**Created:** [November 16, 2021, 7:31am UTC](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213 "2021-11-16T07:31:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yasunori.mahata](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yasunori.mahata/32/32487_2.png) [@yasunori.mahata](https://community.auth0.com/u/yasunori.mahata)\
**Post date:** [November 16, 2021, 7:31am UTC](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213/1 "2021-11-16T07:31:31Z")

</div>

I’m trying to revoke a refresh token with the Management API as described [in the document](https://auth0.com/docs/security/tokens/refresh-tokens/revoke-refresh-tokens).

However, when I run a curl command as follows, it fails with the errorCode: “insufficient\_scope”

```auto
$ curl --header "Authorization: Bearer $TOKEN" \
       --data '{"user_id": "auth0|xxx", "type": "refresh_token", "client_id": "xxx" }' \
     https://xxx.us.auth0.com/api/v2/device-credentials

{"statusCode":403,"error":"Forbidden","message":"Insufficient scope, expected any of: create:current_user_device_credentials","errorCode":"insufficient_scope"}

```

Based on the document, it seems the API just needs `read:device_credentials` scope, but the error message is saying `create:current_user_device_credentials` is needed. Which one is correct?

By the way, I get the Bearer token with the following Node.js code:

```auto
const ManagementClient = require("auth0")
const auth0 = new ManagementClient.ManagementClient(
  {
    domain: ...,
    clientId: '...',
    clientSecret: '...',
    scope: 'create:users read:users update:users read:device_credentials'
  }
)

auth0.getAccessToken();

```

When I add the “create:current\_user\_device\_credentials” to the scope of the ManagementClient constructor, I get an error that says:

```auto
{"error":"access_denied","error_description":"Client has not been granted scopes: create:current_user_device_credentials"}

```

Where can I set the scope appropriately?

Thanks,

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [November 16, 2021, 10:47pm UTC](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213/3 "2021-11-16T22:47:03Z")

</div>

Hi @yasunori.mahata,

Welcome to the Auth0 Community!

It looks like you are trying to send a POST request (you are using the `--data` flag) when should be sending a GET request.

> **[How to make API request from command line with CURL](https://dev.to/iggredible/how-to-make-api-request-with-curl-kg8)**
>
> Getting started with cURL HTTP request

---

<div class="post-metadata">

**Author:** ![yasunori.mahata](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/yasunori.mahata/32/32487_2.png) [@yasunori.mahata](https://community.auth0.com/u/yasunori.mahata)\
**Post date:** [November 17, 2021, 10:18am UTC](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213/4 "2021-11-17T10:18:18Z")

</div>

Hi @dan.woda, thanks for your support!

Yeah, it was caused by my stupid mistake 🤦‍♂️ Just for the record, the following one worked as expected:

```auto
$ curl --request GET --header "Authorization: Bearer $TOKEN" "https://xxx.us.auth0.com/api/v2/device-credentials?type=refresh_token&client_id=xxx&user_id=auth0%7Cxxx"

```

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [November 23, 2021, 9:10pm UTC](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213/5 "2021-11-23T21:10:11Z")

</div>

Thanks for posting your update! Glad you got it resolved 😄

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 8, 2021, 9:10pm UTC](https://community.auth0.com/t/failing-to-call-get-api-v2-device-credentials-endpoint/73213/6 "2021-12-08T21:10:57Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.