Inconsistent scope for REST vs Webhook for fulfillment events
As far as I can tell, an app can read fulfillment events with the read_orders scope.
However, this doesn't seem to be enough to subscribe to the fufillment event webhooks (fulfillment_events/create, fulfillment_events/delete). This requires the read_fulfillments scope.
It doesn't make sense that the app can read these but not subscribe to the webhooks.
Can anyone shed some light? I think it's a bug. Those webhooks should be allowed with only read_orders scope, right?