WebSocket Notification API subscription failing with 403

Trying to subscribe to conversation events via the Genesys Cloud Notification API WebSocket. I’m getting a clean bearer token using client_credentials, but the connection drops immediately with a 403 Forbidden. The docs mention specific scopes but I have the standard set.

Here’s the payload I’m sending in the query string. Any idea why it’s rejecting the subscription? I’ve checked the token validity and it’s fine for other endpoints.

wss://api.mypurecloud.com/v2/analytics/events/subscribe?events=conversation:created&access_token=eyJ...

The 403 usually means your token lacks notifications:subscribe. Client credentials grants don’t get these by default. Check your app settings in Genesys Cloud. You need to add that scope explicitly. Here’s how to verify the token scopes using curl before connecting.

curl -X POST https://api.mypurecloud.com/oauth2/token \
 -H "Authorization: Basic {base64(client_id:client_secret)}" \
 -d "grant_type=client_credentials&scope=notifications:subscribe"