Overview of Scopes and Claims

Scopes

A scope specify what access privileges are being requested to be included as claim in the JWT token. The following is the exhaustive list of scopes supported by the Axioms platform:

Name	Description	Requires user context
openid	Required scope for all OpenID authorization requests.	Yes
email	Token claims should include the end user email and if that email was verified. This will add following claims to token: email, email_verified	Yes
phone	Token claims should include the end user phone numbers and if that phone number was verified. This will add following claims to token: phone_number, phone_number_verified	Yes
profile	Token claims should include profile details of the end user. If available includes one or more of following claims: name, family_name, given_name, middle_name, nickname preferred_username, picture, website, gender, birthdate, zoneinfo, locale, updated_at .	Yes
address	Token claims should include address details of the end user.	Yes
offline_access	Token response should include a refresh token.	No
roles	Token claims should include a list of roles assigned to the end user.	No
orgs	Token claims should include a list of organizations assigned to the end user.	No

Using Scope Parameter

When requesting authorization, a client application should use scope parameter to include a string containing a space-separated scopes.

Some common scope combinations

scope=openid profile email phone

explain this code snippet

scope=openid profile email roles

explain this code snippet

scope=openid profile email roles orgs

explain this code snippet

scope=openid profile email roles offline_access

explain this code snippet

Claims

Claims are specific attributes about a user or JWT token and it's context.

Claims about JWT token

Claim	Description	Include by default	ID Token	Access Token
iss	Issuer - claim identifies the principal that issued the JWT token	✅	✅	✅
sub	Subject - claim identifies the principal that is the subject of the JWT	✅	✅	✅
aud	Audience - claim identifies the recipients that the JWT is intended for. It can be a single recipient or an array of recipients.	✅	✅	✅
exp	Expiration Time - claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing	✅	✅	✅
nbf	Not Before - claim identifies the time before which the JWT MUST NOT be accepted for processing	✅	✅	✅
iat	Issued At - claim identifies the time at which the JWT was issued	✅	✅	✅
jti	JWT ID - claim provides a unique identifier for the JWT token	✅	✅	✅
auth_time	Time when the End-User authentication occurred.	✅	✅	✅
amr	Authentication methods references i.e. authentication factor used to authenticate user. It can be one or more values from this list: pwd, otp, mfa, swk, face, fpt, kba	✅	✅	✅
azp	Authorized party - the party to which the token was issued	✅	✅	❌
client_id	Client id of the client to which the token was issued	✅	✅	✅
scope	Scopes requested in authorization request. Included if not null.	❌	✅	✅
{iss}/claims/roles	Roles assigned to the end user. Included if roles in scope or claims parameter of authorization request	❌	✅	✅
{iss}/claims/orgs	Organizations assigned to the end user. Included if orgs in scope or claims parameter of authorization request	❌	✅	✅
at_hash	Hash of access token send along with id token by authorization server to client	❌	✅	❌
c_hash	Hash of authorization code sent by authorization server to client	❌	✅	❌
s_hash	Hash of state variable sent by client in authorization request	❌	✅	❌
nonce	Used to associate a client authorization request with an ID Token	❌	✅	❌

Claims about user

Claim	Description
name	Full name
given_name	Given name(s) or first name(s)
family_name	Surname(s) or last name(s)
middle_name	Middle name(s)
nickname	Casual name
preferred_username	Shorthand name by which the End-User wishes to be referred to
profile	Profile page URL.1
picture	Profile picture URL
website	Web page or blog URL
email	Preferred e-mail address
email_verified	True if the e-mail address has been verified; otherwise false
gender	Gender
birthdate	Birthday
zoneinfo	Time zone
locale	Locale
phone_number	Preferred telephone number
phone_number_verified	True if the phone number has been verified; otherwise false
address	Preferred postal address
updated_at	Time the information was last updated

---

1. Currently profile url is not supported by Axioms user profile.↩