In this article, we will look at the Connect scope values of Class APIs.
The Class API supports a subset of the OpenID Connect scope values, which are defined below.
There is a set of custom values restricting the scope of the request to a Fund or Business, and this involves specifying the resources and operations available within that Fund or Business.
The Class API supports the following standard OpenID Connect scopes as defined in OpenID Connect Core 1.0.
| Scope value | Description |
|---|---|
openid | Required for all OpenID Connect requests. When specified, an ID Token will be returned: - In the authorisation response, when response_type contains id_token- In the token response, when the response_type contains code |
profile | When specified, the following Standard Claims will be included in UserInfo responses: - name- given_name- middle_name- family_name- gender |
email | When specified, the email Standard Claims will be included in ID Tokens and UserInfo responses. |
address | When specified, the address Standard Claims will be included in UserInfo responses. |
phone | When specified, the phone_number Standard Claims will be included in UserInfo responses. |
When combined with the openid scope value, class_profile allows the following additional OpenID Claims to be retrieved from the UserInfo Endpoint:
| Field Name | Description |
|---|---|
business_name | The name of the user's business |
business_code | The code for the user's business in Class |
business_address | The address of the user's business, in the same format as the standard address Claim |
business_phone_number | The phone number of the user's business, in the same format as the standard phone_number Claim |
class_role | A comma-delimited list of strings describing the user's role in Class, e.g. Administrator, Access Controller, adviser |
This scope value specifies if the client is requesting Business or Fund level access. This enables the client to specify a specific Business or Fund or allow the authorising user to select one.
This scope value is required if any access specifiers are present.
The format of this scope value is target:context. The parameters of the URL are specified as follows:
b:Indicates the client is requesting access to a Business. The user will be prompted to select a Business.f:Indicates the client is requesting access to a single Fund. The user will be prompted to select a Fund.b/BUSINESS:Indicates the client is requesting access to the specific Business with the code BUSINESS.f/BUSINESS/FUND:Indicates the client is requesting access to the specific Fund in Business BUSINESS with code FUND
Please note that the above request to access a single fund and request to access a specific fund in a business code is currently not supported.
Refer to the documentation for the specific API endpoints you wish to use to determine the access specifiers required by your integration.
Class strongly recommends that your integration requests the minimum set of scopes possible and does not request unnecessary scopes.
These scope values allow the client to request access to specific resources, and the operations they wish to perform using those resources.
The format of this scope value is context, resource and operation. The components are defined as follows:
context: The context for the resource that access is being requested for, e.g. business, fund. This component is required for each access specifier.resource: Indicates the resources that access is being requested for, e.g. members, funds, details. If omitted, the request is for all resources within the specified context.operation: Indicates the operation the client is requesting access to perform. e.g. read, maintain, create. If omitted, it defaults to read.
| Specifier | Description | Implied Permissions |
|---|---|---|
business.fund.list | List summarised data of funds in the business | - |
business.fund.create | Create new funds in the business | - |
business.details.read | View details about users of the business | - |
fund.details.read | View basic fund details | - |
fund.details.maintain | View and maintain basic fund details | fund.details.read |
fund.member.read | View member details | - |
fund.member.maintain | View and maintain member details | fund.member.read |
fund.read | View all fund information | fund.*.read |
fund.maintain | View and maintain all fund information | fund.*.maintain |
The following additional requirements apply when the offline_access scope is requested:
offline_accessis only supported for the authorisation grant flow used by Authorisation Code Flow. It cannot be used by Implicit Flow.- When making an Authorisation request, the
promptparameter must be included and its value must beconsent. - The
include_granted_scopesscope value cannot be used concurrently with theoffline_accessscope value. Requests for offline access must always include the full set of required access specifiers.