Queensland University of Technology OAuth Scopes

# This file was generated by API Evangelist for the qut profile on 2026-09-01. It was NOT published
# by Queensland University of Technology. The `method:` key states how the content was obtained and
# `source:` names the live URLs it was read from.
specification: API Evangelist Scopes
specificationVersion: '0.1'
provider: Queensland University of Technology
providerId: qut
generated: '2026-09-01'
method: derived
source: >-
  The `scopes_supported` array of the live OpenID Provider Metadata document at
  https://esoe.qut.edu.au/auth/realms/qut/.well-known/openid-configuration, HTTP 200,
  fetched 2026-09-01 and archived at examples/qut-esoe-openid-configuration.json.
description: >-
  Every scope below is transcribed verbatim from QUT's own live discovery document. None is
  inferred and none is invented. Eleven are Keycloak / OpenID Connect standard scopes; three
  (`Service_Account`, `service_account`, `Integsvc_test_client`) are QUT-defined client scopes and
  are the only place in this profile where QUT's internal integration vocabulary is publicly
  visible. The duplicate casing of the service-account scope is QUT's, not a transcription error.
surfaces:
  - name: QUT ESOE OpenID Connect Provider
    contract: openapi/qut-esoe-openid-connect-openapi.yml
    x-operator: institution
    issuer: https://esoe.qut.edu.au/auth/realms/qut
    scopes:
      - name: openid
        standard: true
        description: Required to obtain an ID token; selects the OpenID Connect flow.
      - name: profile
        standard: true
        description: Basic profile claims — name, given_name, family_name, preferred_username.
      - name: email
        standard: true
        description: Email address claim.
      - name: phone
        standard: true
        description: Phone number claim.
      - name: address
        standard: true
        description: Address claim.
      - name: offline_access
        standard: true
        description: Issues a refresh token usable while the end user is not present.
      - name: roles
        standard: false
        description: Keycloak realm and client role claims.
      - name: basic
        standard: false
        description: Keycloak baseline claim set (sub, auth_time).
      - name: acr
        standard: false
        description: Authentication context class reference claim.
      - name: web-origins
        standard: false
        description: Keycloak scope controlling allowed CORS origins for the client.
      - name: microprofile-jwt
        standard: false
        description: MicroProfile JWT claim mapping (upn, groups).
      - name: Service_Account
        standard: false
        institution_defined: true
        description: >-
          QUT-defined client scope. Named consistently with a machine-to-machine client using the
          client_credentials grant. No public documentation of what it grants was found.
      - name: service_account
        standard: false
        institution_defined: true
        description: >-
          QUT-defined client scope, lowercase variant of the above. Both are advertised
          simultaneously by the live discovery document.
      - name: Integsvc_test_client
        standard: false
        institution_defined: true
        description: >-
          QUT-defined client scope, apparently for an integration-services test client. Recorded
          because QUT advertises it publicly; no documentation of it was found.