generated: '2026-08-25'
method: probed
source: >-
  scopes_supported read verbatim from
  https://kc.mcisaas.com/auth/realms/numa-realm/.well-known/openid-configuration (HTTP 200),
  saved in well-known/micro-connect-kc-numa-realm-openid-configuration.json
docs: null
note: >-
  These are the OpenID Connect / Keycloak built-in client scopes the numa-realm authorisation
  server advertises anonymously. Micro Connect publishes NO business-domain scope reference —
  there is no documented scope for revenue reporting, order-detail submission, settlement
  export or any other Open Platform capability. Authorisation for those capabilities is
  carried in Keycloak realm/client ROLES inside the access token (the Open Platform bundle
  reads resource_access[clientId].roles), and that role catalogue is not published. Do not
  read this list as an API permission model; it is the identity layer only.
authorization_server: https://kc.mcisaas.com/auth/realms/numa-realm
scope_count: 10
scopes:
- name: openid
  description: Required OpenID Connect scope; requests an ID token.
  standard: true
- name: profile
  description: Standard OIDC profile claims (name, given_name, family_name, preferred_username).
  standard: true
- name: email
  description: Standard OIDC email claim.
  standard: true
- name: phone
  description: Standard OIDC phone_number claims.
  standard: true
- name: address
  description: Standard OIDC address claim.
  standard: true
- name: roles
  description: Keycloak built-in scope; adds realm and client role mappings to the token.
  standard: false
- name: web-origins
  description: Keycloak built-in scope; adds allowed CORS origins to the token.
  standard: false
- name: offline_access
  description: Requests an offline refresh token.
  standard: true
- name: microprofile-jwt
  description: Keycloak built-in scope; adds MicroProfile JWT claims (upn, groups).
  standard: false
- name: acr
  description: Authentication Context Class Reference; realm advertises acr_values 0 and 1.
  standard: true