Screen Recording API returning 403 Forbidden when fetching session data for WFM adherence

Trying to understand why our automated adherence check script is suddenly hitting a wall with the Screen Recording API. We have a custom tool built in Python that pulls screen recording metadata to cross-reference with WFM schedule adherence. It has been running flawlessly for the past six months, but since the last platform update, we are getting a consistent 403 Forbidden response when calling GET /api/v2/analytics/screensessions/{screenSessionId}.

The script runs under a service account that has the analytics:screen-recording:view permission explicitly granted. I have double-checked the role assignments and even tried creating a new service account with the Admin role just to rule out permission creep, but the result is identical. The error payload is minimal, just {"message": "Forbidden", "status": "error"}.

What is particularly strange is that if I use the exact same token in Postman, the call succeeds immediately. This suggests the issue might not be with the token itself, but perhaps with how the script is handling the request headers or the specific user context associated with the screen session. We are based in Central Time (America/Chicago), and the failures started right after our weekly schedule publish on Tuesday morning.

Could there be a new restriction on programmatic access to screen recording data that requires an additional OAuth scope? Or is this a known issue with the analytics endpoints when accessed via non-browser clients? We need this data to validate agent self-service shift swaps against actual logged activity. If we cannot automate this check, our manual review process will lag by days, which is unacceptable for our tight SLA requirements. Any insights from the community on recent changes to the Screen Recording API permissions would be greatly appreciated.

How I usually solve this is by verifying the specific scope permissions assigned to the API key, as recent platform updates often tighten access controls for screen session data. The standard analytics:read scope is frequently insufficient for detailed screen session metadata, especially when cross-referencing with WFM adherence metrics. You likely need to add screenrecordings:read or a similar specialized scope to the key.

# Example: Check required scopes in your API key configuration
required_scopes = [
 "analytics:read",
 "screenrecordings:read", # Critical for screen session details
 "users:read" # Often needed for agent identification
]

# Ensure these are present in the key's scope list

Double-check the key configuration in the admin portal to ensure these scopes are active. Missing even one specific permission can trigger a 403 error on endpoints that previously worked. It is also worth reviewing the audit logs to confirm if the key was recently modified or if new compliance rules were applied to the tenant.