3782344 - OData API returns 403 error with admin-area-scoped token - SAP SuccessFactors Work Zone

When calling - Folders(Id='FOLDER_ID',FolderType='PrivateFolder')/PrivateFolderMembers - a HTTP 403 is returned with the expression: “Expansion of 'PrivateFolderMembers' on Entity Type 'Folder' is not allowed in the administrative area 'AREA_NAME'.”

1. Access to the same resources via the frontend works for the same user/token.
2. Access via endpoint "Folders(Id='FOLDER_ID', FolderType='PrivateFolder')/ContentItems" also works.

• SAP Build Work Zone Advanced Edition
• SAP SuccessFactors Work Zone

1. Use an alias user that operates within an administrative area and has multiple integrated workspaces.
2. Call: /Folders(Id='FOLDER_ID',FolderType='PrivateFolder')/PrivateFolderMembers and observe HTTP 403 with the expansion-not-allowed message: 
   • Response Status Code: 403
   • Respone Message: Expansion of 'PrivateFolderMembers' on Entity Type 'Folder' is not allowed in the administrative area 'AREA_NAME'.

This is expected behavior as per Product design. 

When using an admin-area-scoped OAuth token, the API enforces restrictions on certain navigations. PrivateFolderMembers on Folder and navigations such as Member/MemberKudos for admin-area-scoped tokens are not accessible/expandable because membership or resources may span outside the current administrative area.

Exposing that list through an area-scoped token would leak cross-area member data — defeating the purpose of the area scope.

The frontend is unaffected due to frontend session authentication not being admin-area-scoped.

ContentItems is also not affected because a folder's content list is not cross-area data and is not subject to the same rule. 

Verify the OAuth client used for the integration is admin-area-scoped to a specific administrative area.

If area-scoped, register and use a separate, non-admin-area-scoped OAuth client for calls that require restricted navigations. It will return the full membership list, mirroring what is shown in the frontend.

Customers are advised to review and align this approach with the organization’s data-protection and compliance requirements, as removing the administrative-area scope broadens data visibility.

Alternatively, where possible, prefer navigations that are not subject to cross-area restrictions (for example, ContentItems) when area scoping must be retained.

Help Portal - Useful resource on SAP Jam & Work Zone APIs and Support scope

work zone odata, privatefoldermembers 403, admin-area-scoped token, administrative area scope, odata navigation expansion, private folder members api, 403 forbidden, cross-area data restriction, content items works, frontend vs api, oauth client scope, folder members expansion blocked, api access policy,  INC29806372 , KBA , LOD-SF-SWZ-DEV , Custom Development and API concerns , How To