Fortnox has formulated a change to become effective as of September 30, 2026:
Notice – API scope enforcement change effective 2026-09-30
We are writing to inform you of a scope enforcement discrepancy identified in a subset of our API endpoints. You are receiving this notice because our logs show API traffic within the past month from at least one clientId registered to your organization.What we found
Three endpoint categories currently do not correctly enforce scope validation. Requests to these endpoints are being accepted and returning 200 OK, including a full response payload, even when the required scope is missing from the presented JWT. This is a deviation from intended behavior; these calls should be rejected when the corresponding scope is not granted.
Affected endpoints
Endpoint category Scope required /api/warehouse/* warehouse /api/warehouse/documentdeliveries/custom/* warehousecustomdocument /api/time/* timereporting What is changing, and when
Starting 2026-09-30, calls to the endpoints listed above will return 403 Forbidden if the accompanying JWT does not include the corresponding required scope. This is not a new restriction, it is the intended, correct behavior that is currently not being enforced
Why this matters to you
If your integration has been calling any of these endpoints without the corresponding scope explicitly issued, your calls have been succeeding only due to this enforcement gap. From 2026-09-30, any such request will fail with 403 Forbidden instead of returning a successful response.
What we recommend you do before 2026-09-30
Review your integration’s current scope configuration against the table above. Confirm whether your clientId has been issued the correct scopes for the endpoints you use.
If a required scope is missing, request it be added well ahead of the enforcement date to avoid disruption in production.The JWTs you currently have active without these scopes need to be renewed with the correct scopes to continue functioning with above-mentioned endpoints. This means that in the Auth Code step, you need to ensure that you, for the scope parameter, include all relevant scopes for your use case. The user therefore needs to issue new consent that includes the scope or scopes that are currently missing.