{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40626,"path":"platform-security/authentication/rest-api-scope-troubleshooting.md","title":"REST API scope troubleshooting","bundle":null,"doc_type":null,"release":"australia","body":"\n# REST API scope troubleshooting\n\nTroubleshooting actions can help resolve common issues when setting up or running the REST API scope.\n\n<table id=\"table_upj_wjr_4tb\"><thead><tr><th>\n\nIssue\n\n</th><th>\n\nAction\n\n</th></tr></thead><tbody><tr><td>\n\nREST API is linked with auth scope, however in runtime there is no auth scope check even using Bearer token authentication.\n\n</td><td>\n\n-   Make sure the sys\\_api\\_access\\_policy record is active. Runtime ignores inactive records.\n-   Check if property **com.glide.rest.api.auth.scope.check.enable** is set to false.\n-   Check if the OAuth token has `useraccount` auth scope.\n\n</td></tr><tr><td>\n\nREST API is linked with **auth\\_scope1**, however the access token which has **auth\\_scope2** is also able to access it.\n\n</td><td>\n\n-   Check if this record is active.\n-   Check for this REST, check if any other records, which have the same APIs but different apply methods, versions, or resource.\n\n</td></tr><tr><td>\n\nREST API is linked with auth scope, however in runtime there is no auth scope check for **basicAuth** and **mutualAuth**.\n\n</td><td>\n\nIt is expected since the REST API auth scope only applies to the OAuth access token or OIDC token. It doesn’t apply BasicAuth, Session Cookie and Certificate based authentication.\n\n</td></tr><tr><td>\n\nREST API call return 403 when using the OAuth access token.\n\n</td><td>\n\nCheck for the error message \"Missing required api access scope\". If found then the auth scope check fails for this REST API\n\n</td></tr><tr><td>\n\nPre-defined `useraccount` is deleted and not sure to restore.\n\n</td><td>\n\nExport `useraccount` as `xml` from the other instance and import it or create an `useraccount` and modify system property **glide.oauth.token.scope.useraccount** to the newly created sys\\_id record.\n\n</td></tr></tbody>\n</table>## Frequently asked questions\n\nFollowing are some of the frequently asked question when using the REST API Auth scope:\n\n-   **Can one OAuth token be linked with several auth scopes?**\n\n    Yes, one `oauth_entity` can be linked with multiple auth scopes, every OAuth token issued by this `oauth_entity` has the same auth scopes.\n\n-   **Can different OAuth tokens with different auth scopes access the same REST API?**\n\n    Yes, for the same REST API, it may be accessed by different auth scopes. As long as one auth scope is matched, the auth scope returns the results.\n\n-   **Can OAuth access token with `useraccount` auth scope access any REST APIs?**\n\n    Yes, the `useraccount` has full access to auth scope.\n\n-   **Can OAuth access token OAuth scope be changed dynamically?**\n\n    Yes, the auth scoped is not hard-coded with the access token in the `oauth_credential` table. Instead auth scope is getting from linked `oauth_entity` during runtime.\n\n-   **Can OAuth token keep same auth scopes after refresh?**\n\n    Yes, auth scope will not change after token refresh, unless `oauth_admin` modify auth scope linked with `oauth_entity`.\n\n-   **Pre-defined `useraccount` auth scope record is deleted, can a new auth scope with name `useraccount` be created?**\n\n    Creating a new auth scope with the same `useraccount` doesn't work. In the runtime, it uses the `sys_id` instead of name to do the auth scope check, modify the system property **glide.oauth.token.scope.useraccount** to the newly created `sys_id` record.\n\n-   **If admin modify auth scoped linked with `oauth_entity`, are all the existing OAuth access token issued by this OAuth entity changed also?**\n\n    Yes, the auth scope is not directly linked with the OAuth access token, it is getting from `oauth_entity` during runtime.\n\n-   **Can different OAuth access tokens issued by the same `oauth_entity` have different auth scopes?**\n\n    No, all access to the token is issued by the same `oauth_entity` and always have the same auth scopes.\n\n-   **Can a user define different auth scopes for a particular endpoint?**\n\n    No, there is a unique constrain check for a particular REST API endpoint. However for the same REST API endpoint, it may have more than one matched auth scopes.\n\n-   **Is the auth scope check used for BasicAuth also?**\n\n    No, auth scope check is only OAuth access token and OIDC token, it is not applied for **basicAuth** and **mutualAuth**\n\n\n"}}