# Can't read channel bans with moderation:read permission

**URL:** <https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015>\
**Category:** API\
**Created:** [April 16, 2020, 12:42pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015 "2020-04-16T12:42:05Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Francesco\_Jimi](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/francesco_jimi/32/7691_2.png) [@Francesco\_Jimi](https://discuss.dev.twitch.com/u/Francesco_Jimi)\
**Post date:** [April 16, 2020, 12:42pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/1 "2020-04-16T12:42:05Z")

</div>

Pretty much as the title says, from my application I can’t read channel bans even if the access token has the `moderation:read` scope granted. Whenever I try to do a request to this endpoint

```auto
https://api.twitch.tv/helix/moderation/banned?broadcaster_id=<channel_id>&user_id=<user_id>
```

where `channel_id` is the ID of the broadcaster channel and `user_id` is the ID of the user I want to check if is banned. In the header I’m passing the application Client ID, the `application/vnd.twitchtv.v5+json` Accept header and the access token of the broadcaster with the `moderation:read` scope granted with OAuth. Is something missing from the request or is something going on? Because it worked until today with no problem. It also refreshed the token several times before today, so I don’t know if it could be related to the refresh token endpoint not returning a correct token

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 16, 2020, 12:47pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/2 "2020-04-16T12:47:04Z")

</div>

> [@Francesco\_Jimi](#):
>
> the `application/vnd.twitchtv.v5+json` Accept header

You don’t need this header with Helix

> [@Francesco\_Jimi](#):
>
> the access token of the broadcaster with the `moderation:read` scope granted with OAuth

You should use the validatity endpoint

> **[Authentication](https://dev.twitch.tv/docs/authentication/#validating-requests)**
>
> Authentication

To confirm your token is correct, for the right user\_id (broadcaster\_id) and has the scopes you think it does.

> [@Francesco\_Jimi](#):
>
> Is something missing from the request or is something going on?

Whats the actual error message are you getting?

Similar code flow is working as expected here!

---

<div class="post-metadata">

**Author:** ![Francesco\_Jimi](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/francesco_jimi/32/7691_2.png) [@Francesco\_Jimi](https://discuss.dev.twitch.com/u/Francesco_Jimi)\
**Post date:** [April 16, 2020, 12:51pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/3 "2020-04-16T12:51:49Z")

</div>

From the validate endpoint I get this response

```auto
{
    "client_id": "my-application-client-id",
    "login": "channel-name",
    "scopes": [
        "moderation:read",
        "user_read",
        "user_subscriptions"
    ],
    "user_id": "channel-user-id",
    "expires_in": 9710
}

```

Of course I’ve changed the details about the various IDs, but as you can see the scope is right. However from the above endpoint I get this

```auto
{
    "error": "Unauthorized",
    "status": 401,
    "message": "Missing scope: moderation:read"
}

```

The authorization token used in both cases is, of course, the same

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 16, 2020, 12:56pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/4 "2020-04-16T12:56:09Z")

</div>

Very odd, looks like you have a correct token (user token not app access), but the API rejects it.

You sure your code doing the call to the ban’s API is using the right token in case you have multiple in play?

Aside from that it’s a really odd issue. Try running the call manually cURL on the command line, to check if it’s the token or your code.

---

<div class="post-metadata">

**Author:** ![Francesco\_Jimi](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/francesco_jimi/32/7691_2.png) [@Francesco\_Jimi](https://discuss.dev.twitch.com/u/Francesco_Jimi)\
**Post date:** [April 16, 2020, 1:06pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/5 "2020-04-16T13:06:39Z")

</div>

I’m actually trying the calls from postman. However I tried using curl and I get the same 401 error

 ![image](https://d2opxh93rbxzdn.cloudfront.net/original/2X/4/42e3037ee35f952532ef5648ff735ccf5827bc9f.png)

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 16, 2020, 1:07pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/6 "2020-04-16T13:07:07Z")

</div>

Helix uses "Bearer " not "OAuth " in the header.

There is your issue

> Authorization: Bearer YOURKEY

---

<div class="post-metadata">

**Author:** ![Francesco\_Jimi](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/francesco_jimi/32/7691_2.png) [@Francesco\_Jimi](https://discuss.dev.twitch.com/u/Francesco_Jimi)\
**Post date:** [April 16, 2020, 1:08pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/7 "2020-04-16T13:08:05Z")

</div>

But…but…

> [@Requiring OAuth for Helix Twitch API Endpoints](https://discuss.dev.twitch.com/t/requiring-oauth-for-helix-twitch-api-endpoints/23916):
>
> In an effort to standardize authentication and provide security improvements for the Twitch community, OAuth will soon be required for all Twitch API endpoints in the new Twitch API, also known as “Helix.” The goal of this announcement is to provide a timeline, full details of this new requirement, and answer a few anticipated questions. Please feel free to add further questions via the comments below and we appreciate your feedback during this process. Update (2020/06/02): See “How will this …

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 16, 2020, 1:08pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/8 "2020-04-16T13:08:51Z")

</div>

OAuth is OAuth

The prefix is irrelevant.

It’s still an OAuth key, but helix requires the prefix to be “bearer”

You’ve misunderstood the announcement.

> [@Requiring OAuth for Helix Twitch API Endpoints](https://discuss.dev.twitch.com/t/requiring-oauth-for-helix-twitch-api-endpoints/23916/1):
>
> Here is a sample request to show the headers mentioned above.
> 
> ```auto
> curl -H 'Authorization: Bearer cfabdegwdoklmawdzdo98xt2fo512y' \
> -H Client-ID: uo6dggojyb8d6soh92zknwmi5ej1q2' \
> -X GET 'https://api.twitch.tv/helix/users?id=44322889'
> 
> ```

It’s even in the example in that very post

Soon all calls to Helix will require the use of an OAuth token, Helix uses the word “Bearer” as the OAuth prefix

---

<div class="post-metadata">

**Author:** ![Francesco\_Jimi](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/francesco_jimi/32/7691_2.png) [@Francesco\_Jimi](https://discuss.dev.twitch.com/u/Francesco_Jimi)\
**Post date:** [April 16, 2020, 1:09pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/9 "2020-04-16T13:09:59Z")

</div>

Yep, look like I totally did 😅 Still strange because it used the OAuth prefix until today and has no issues 🤷‍♂️

---

<div class="post-metadata">

**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\
**Post date:** [April 16, 2020, 1:10pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/10 "2020-04-16T13:10:50Z")

</div>

Then that shouldn’t of worked at all.

Helix has already required Bearer, and if Twitch snuck in a bug, they have now fixed that bug

---

<div class="post-metadata">

**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\
**Post date:** [May 16, 2020, 1:12pm UTC](https://discuss.dev.twitch.com/t/cant-read-channel-bans-with-moderation-read-permission/25015/11 "2020-05-16T13:12:03Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.