# LinkedIn "403 access denied" on the agent's profile API call - the app scope was never approved

## TL;DR

The LinkedIn app never got the profile scope approved, so the API 403s every call. Request the scope through LinkedIn's developer review, use only approved scopes in the meantime, and handle 403 as 'scope missing', not 'retry'. Unapproved scopes do not work no matter how correct the code is.

```text
403 Access Denied (LinkedIn profile API, scope never approved)
```

## Steps

1. Check the app's approved scopes in the LinkedIn developer portal.
   Expected: The profile scope is missing.

2. Request the scope through LinkedIn's review process with the use case documented.
   Expected: The request is in the queue.

3. Meanwhile, use only approved scopes; redesign the enrichment to work without the profile scope.
   Expected: The agent functions within its grant.

4. Handle 403 as a scope signal: log it, alert, do not retry in a loop.
   Expected: 403s stop burning quota.

5. Once approved, update the OAuth flow to request the scope and re-consent.
   Expected: The calls succeed.

## When to use

- LinkedIn 403s on profile API calls
- the scope was never approved
- the app is new

## When not to use

- the scope is approved (check the access token's actual scopes)
- the 403 is on a different API with different rules
- the app is in development mode (dev apps have their own limits)

## Tool compatibility

- LinkedIn API
- OAuth scopes

## Variant phrasings

- "linkedin 403 access denied profile"
- "linkedin scope never approved"
- "linkedin r_liteprofile 403"

## Why it happens

LinkedIn gates profile data behind scopes that require developer review, and the API 403s without them no matter how perfect the request. Agents built against the docs assume the scope is available; the approval step is a human process with a queue. The 403 is LinkedIn saying 'not yet'.

## Edge cases

- development-mode apps have tighter limits; the 403 can mean mode, not scope
- re-consent is required after scope approval; the old tokens do not gain the scope
- document the approved scopes; the next developer will assume they are all available

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_90ymveCi9Ym17F6Wmeu6WA