Why does the bulk export job fails with a 403 Forbidden error when attempting to include specific legal hold metadata fields? The standard export works fine, but adding the legal_hold_status attribute triggers an immediate failure in the London region environment.
We are using the v2 recordings API with valid scopes for recording:read and legal:hold:read. The audit trail shows the job initiates correctly, but the S3 integration returns an access denied response specifically for the metadata payload. This breaks our chain of custody process for discovery requests.
Have you tried explicitly adding the legal:hold:export scope to the OAuth token used by the S3 integration? The legal:hold:read scope only permits viewing hold status, not exporting the associated metadata payload. The 403 is a permissions mismatch, not an S3 configuration error. Update the app credentials and retry the job.
How I usually solve this is by checking the scope permissions first, similar to how Zendesk requires specific ticket tags for export access. The legal:hold:export scope is indeed the missing piece here.
Thanks for the quick fix suggestion above. It resolved the 403 error immediately after updating the OAuth credentials.