When I request @self data of a non-app installed user, if I specify ANY fields what so ever (even thumbnailUrl or displayName) I get a 401 response. This happens for friends and non-friends of the current user.

 If I delete the fields, I get the correct response.

 What gives? Why is this happening?

hey there,

You can't make request for non-friends data, no matter that person has app installed or not.

Our current permission model doesn't allow to get non-install friends data unless it's canvas request. Though your suggestion has been considered and change will be made available soon  so you can request public data of the friend as far as friend is not blocking the app and friend has given permissions to non-install app.

This change will be LIVE in 2-3 weeks, meanwhile you can make it work by passing query parameter opensocial_surface="CANVAS" in all your request.

This will fix your problem.

Thanks