Google fit permission problems

Question

I would like to get some technical help with the google fit rest Rest API.

I am making an app that requires access to the location information and as a response for my request I am getting this json.

{
  "access_token": "ya29.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 
  "scope": "https://www.googleapis.com/auth/fitness.activity.read https://www.googleapis.com/auth/fitness.location.write https://www.googleapis.com/auth/fitness.location.read https://www.googleapis.com/auth/fitness.body.read", 
  "token_type": "Bearer", 
  "expires_in": 3600, 
  "refresh_token": "1/XXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}

So using the access_token, I made the following request and it works

https://www.googleapis.com/fitness/v1/users/me/dataset:aggregate

Request Body:

{
"startTimeMillis":1543682285000,
"endTimeMillis":1543941485000,
"aggregateBy: [
{ 
  "dataSourceId":"derived:com.google.calories.expended:com.google.android.gms:merge_calories_expended",
  "dataTypeName":"com.google.calories.expended"
}
],"bucketByTime":{"durationMillis":259200000}
}

And I do get a correct response

but when done with the following body (dataSourceId and dataTypeName changed)

{
"startTimeMillis":1543682283000,
"endTimeMillis":1543941483000,
"aggregateBy":[
{
  "dataSourceId":"derived:com.google.location.sample:com.google.android.gms:merge_location_samples",
  "dataTypeName":"com.google.location.sample"}
],"bucketByTime":{"durationMillis":259200000}
}

I got

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "forbidden",
    "message": "No permission to read data for this private data source."
   }
  ],
  "code": 403,
  "message": "No permission to read data for this private data source."
 }
}

Also tried using all the fitness scopes(Read and Write):

 "scope": "https://www.googleapis.com/auth/fitness.activity.write
           https://www.googleapis.com/auth/fitness.blood_pressure.read
           https://www.googleapis.com/auth/fitness.blood_pressure.write
           https://www.googleapis.com/auth/fitness.reproductive_health.write
           https://www.googleapis.com/auth/fitness.activity.read
           https://www.googleapis.com/auth/fitness.reproductive_health.read
           https://www.googleapis.com/auth/fitness.nutrition.write
           https://www.googleapis.com/auth/fitness.body_temperature.write
           https://www.googleapis.com/auth/fitness.body_temperature.read
           https://www.googleapis.com/auth/fitness.nutrition.read
           https://www.googleapis.com/auth/fitness.oxygen_saturation.write
           https://www.googleapis.com/auth/fitness.body.write
           https://www.googleapis.com/auth/fitness.body.read
           https://www.googleapis.com/auth/fitness.oxygen_saturation.read
           https://www.googleapis.com/auth/fitness.blood_glucose.write
           https://www.googleapis.com/auth/fitness.location.write
           https://www.googleapis.com/auth/fitness.location.read
           https://www.googleapis.com/auth/fitness.blood_glucose.read"

Answer 1

As part of Google's ongoing efforts to improve data privacy and security, we are updating the Google Fit API. In November, we made changes to the way location samples can be read through the Fit API for Android and the Fit REST API.

Going forward, applications will only be able to read location samples that they have written to the platform. As the merge_location_samples stream is written internally by the Fit platform, it is no longer accessible to third-party developers.

If your application requires access to location, we encourage you to use the standard means for accessing location on a user's device (see here).