How do I get a user's contacts email data from Windows Live?

Question

I know there are similar questions, but bear with me...

I've hit similar problems to other questioners regarding only getting hashed versions of contact email addresses, and understand why.

The thing is, I've noticed that google+ appear to be able to get contact email addresses just fine using LiveConnect. Using fiddler, I notice that they seem to be requesting an authentication scope "wl.contacts_emails" which does not seem to be documented.

Some googling suggests "enhanced permissions" but there's no mention of this when setting up or editing a windows live connect app on their site.

How do I get this scope on my app?

Nadbus

This scope is working for me. I don't know what's missing for you. Just comment here and I can help you finding a solution. – Consulate

I noticed this and I am interested if this scope still works. I tried it on the live sdk demo and it worked, but refuses to work through oauth from my web app. Is it still working in your case? – Unthrone

@Unthrone See my replies to the answer below. Check the URLs you use to authorize and obtain the access token. – Steep

Answer 1

It works for me in production using wl.contacts_emails IN CONJUNCTION WITH wl.emails. I did not test it with only wl.contacts_emails but linkedin uses both scopes.

After WL.init here is the full scope used:

WL.login({
    scope: ['wl.basic', 'wl.emails', 'wl.contacts_emails'],
}).then(function(response) {

It still isn't documented and Microsoft has explicitly stated that you cannot get the contact email addresses, so use with caution. However, the entire oauth system is the biggest joke of an api I have ever worked with, so I'm guessing it's just so cluster-effed that someone just forgot to write it down.

Edit: the full story is here, Microsoft has confirmed the existence of wl.contacts_emails, and claim they it only works with certain partners who have made agreements with them. However, they are lying to cover their tracks and it works for all clients. The whole thing is a mess.

TL;DR wl.contacts_emails works but they won't admit to it, so there's a chance at some point in the future they could rip it out from under you.

Cedell

This doesn't seem to work anymore. I am getting ?error=invalid_scope&error_description=The%20provided%20value%20for%20the%20input%20parameter%20%27scope%27%20is%20not%20valid%20for%20this%20client%20application. (error "The provided value for the input parameter 'scope' is not valid for this client application.") added to my endpoint URL when I try to use wl.contacts_emails in conjunction with wl.emails and wl.basic as scope. When I call /me/contacts with wl.basic,wl.emails,wl.contacts_emails through the "Interactive Live SDK" however, it does give my contact list with emails. – Steep

Update: I seem to get this error when passing those parameters to https://oauth.live.com/authorize and https://oauth.live.com/token (defaults from oauth2-client library for PHP), but when I changed the URLs to https://login.live.com/oauth20_authorize.srf and https://login.live.com/oauth20_token.srf respectively in the class "Microsoft", following the advice here, it worked. – Steep

Also, I changed wl.emails to wl.signin, following the flow from that article. – Steep