Orders/create webhook with non-sensitive information

[mojoscale]

I am creating an app which needs to subscribe to 'orders/create' and other order based events, but does not need any sensitive customer data. Basically, I need order id, product and timestamps. What is the best way to configure app_scope for such a setup? 

Currently, I try to register a webhook for 'orders/create' topic, but I get 403 (Forbidden) error. I have requested read_order, read_products, and write_products app scope. 

[m20io]

Any updates on this?