# Authorisation Scopes

## Overview

In this article, we will look at the Connect scope values of Class APIs.

The Class API supports a subset of the OpenID Connect scope values, which are defined below.

There is a set of custom values restricting the scope of the request to a Fund or Business, and this involves specifying the resources and operations available within that Fund or Business.

## Supported OpenID Connect Values

The Class API supports the following standard OpenID Connect scopes as defined in [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html).

| Scope value | Description |
|  --- | --- |
| `openid` | Required for all OpenID Connect requests. When specified, an [ID Token](https://support.class.com.au/hc/en-au) will be returned: - In the authorisation response, when `response_type` contains `id_token` - In the token response, when the `response_type` contains `code` |
| `profile` | When specified, the following [Standard Claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) will be included in UserInfo responses: - `name` - `given_name` - `middle_name` - `family_name` - `gender` |
| `email` | When specified, the `email` [Standard Claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) will be included in ID Tokens and UserInfo responses. |
| `address` | When specified, the `address` [Standard Claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) will be included in UserInfo responses. |
| `phone` | When specified, the `phone_number` [Standard Claims](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) will be included in UserInfo responses. |


## The class_profile Scope Value

When combined with the `openid` scope value, `class_profile` allows the following additional OpenID Claims to be retrieved from the UserInfo Endpoint:

| Field Name | Description |
|  --- | --- |
| `business_name` | The name of the user's business |
| `business_code` | The code for the user's business in Class |
| `business_address` | The address of the user's business, in the same format as the standard address Claim |
| `business_phone_number` | The phone number of the user's business, in the same format as the standard phone_number Claim |
| `class_role` | A comma-delimited list of strings describing the user's role in Class, e.g. Administrator, Access Controller, adviser |


## The target Scope Value

This scope value specifies if the client is requesting Business or Fund level access. This enables the client to specify a specific Business or Fund or allow the authorising user to select one.

This scope value is **required** if any access specifiers are present.

The format of this scope value is `target:context`. The parameters of the URL are specified as follows:

- `b:` Indicates the client is requesting access to a Business. The user will be prompted to select a Business.
- `f:` Indicates the client is requesting access to a single Fund. The user will be prompted to select a Fund.
- `b/BUSINESS:` Indicates the client is requesting access to the specific Business with the code BUSINESS.
- `f/BUSINESS/FUND:` Indicates the client is requesting access to the specific Fund in Business BUSINESS with code FUND


Please note that the above request to access a single fund and request to access a specific fund in a business code is currently not supported.

## Access Specifier Scope Values

Refer to the [documentation](/products/class/apis) for the specific API endpoints you wish to use to determine the access specifiers required by your integration.

Class **strongly recommends** that your integration requests the minimum set of scopes possible and does not request unnecessary scopes.

These scope values allow the client to request access to specific resources, and the operations they wish to perform using those resources.

The format of this scope value is context, resource and operation. The components are defined as follows:

- `context`: The context for the resource that access is being requested for, e.g. business, fund. This component is **required** for each access specifier.
- `resource`: Indicates the resources that access is being requested for, e.g. members, funds, details. If omitted, the request is for **all** resources within the specified context.
- `operation`: Indicates the operation the client is requesting access to perform. e.g. read, maintain, create. If omitted, it defaults to **read**.


### Supported Access Specifiers

| Specifier | Description | Implied Permissions |
|  --- | --- | --- |
| `business.fund.list` | List summarised data of funds in the business | - |
| `business.fund.create` | Create new funds in the business | - |
| `business.details.read` | View details about users of the business | - |
| `fund.details.read` | View basic fund details | - |
| `fund.details.maintain` | View and maintain basic fund details | `fund.details.read` |
| `fund.member.read` | View member details | - |
| `fund.member.maintain` | View and maintain member details | `fund.member.read` |
| `fund.read` | View all fund information | `fund.*.read` |
| `fund.maintain` | View and maintain all fund information | `fund.*.maintain` |


## Considerations When Requesting offline_access

The following additional requirements apply when the `offline_access` scope is requested:

- `offline_access` is only supported for the authorisation grant flow used by [Authorisation Code Flow](/products/class/resources/authorisation-code-flow). It cannot be used by Implicit Flow.
- When making an Authorisation request, the `prompt` parameter **must** be included and its value **must** be `consent`.
- The `include_granted_scopes` scope value cannot be used concurrently with the `offline_access` scope value. Requests for offline access must always include the full set of required access specifiers.