Predefined Scopes
The following predefined scopes are available in azuma doa. These scopes determine the returned claims granted to applications and users.
Important: Custom scopes can be defined at the application level for both Authorization Code and Client Credentials Flows, allowing for tailored access control.
Device Binding
| Scope | Description |
|---|---|
offline_access | See - oAuth2 specification. |
permissions_app | Adds permissions of your application to access token as permissions_app. See tokens for more details. |
licenses | Adds licenses to access token. |
Authorization Code
| Scope | Description |
|---|---|
offline_access | See - oAuth2 specification. |
openid | Enables OpenID Connect functionality, allowing retrieval of user identity information. |
profile | Provides access to basic profile information such as name and preferred username. |
email | Grants access to the user's email address. |
tenant_ids | Adds tenant information to access token and id token. |
permissions_app | Adds permissions of your application to access token and id token as permissions_app. See tokens for more details. |
licenses | Adds licenses to access token and id token. |
Client Credentials
| Scope | Description |
|---|---|
tenant_id_admin | Allows to access the API for tenant relevant operations via client. Example for scope with tenant ID '192f01b3-eee4-4eeb-9854-11303eaa4890': 192f01b3-eee4-4eeb-9854-11303eaa4890_admin |
This is also the scope a backend authenticates with to exchange a user's session token for an integration token — see Integration Token Exchange.
Tenant-Configured Integration Scopes
Beyond the predefined scopes above, a tenant can define its own Integration Scopes — named scopes that
mint a deliberately minimal token for a downstream integration. They are configured per tenant rather than
listed here. See Integration Scopes.
A tenant-configured scope may not reuse any predefined scope name, may not begin with azm or end with
_admin, and may not contain azmscope or health-id-epa-integration. A handful of further names are
reserved without appearing in the tables above — offline, permissions_core and tenants. See
Integration Scopes for the complete list.