# API Scopes based on User Profile Attribute

**URL:** <https://devforum.okta.com/t/api-scopes-based-on-user-profile-attribute/7991>\
**Category:** Questions\
**Created:** [February 7, 2020, 7:00pm UTC](https://devforum.okta.com/t/api-scopes-based-on-user-profile-attribute/7991 "2020-02-07T19:00:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmac](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@jmac](https://devforum.okta.com/u/jmac)\
**Post date:** [February 7, 2020, 7:00pm UTC](https://devforum.okta.com/t/api-scopes-based-on-user-profile-attribute/7991/1 "2020-02-07T19:00:58Z")

</div>

Hi,

I am trying to add a basic role-based access control to my APIs as follows:

GET /api/test (needs scope ‘test.get’ in incoming access\_token)  
POST /api/test (needs scope ‘test.post’ in incoming access\_token)

I have these scopes created in an Okta Authorization Server. However, how do I ensure that the scopes included in the access\_token when http://{okta-auth-server}/token is called is based on a specific user profile attribute. One of the user profile attribute (say ‘tester’ = true or false) will determine if scope ‘test.post’ can be requested by a user or not, and hence it might or might not be present in access\_token generated.

Thanks!

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [February 10, 2020, 1:29am UTC](https://devforum.okta.com/t/api-scopes-based-on-user-profile-attribute/7991/2 "2020-02-10T01:29:23Z")

</div>

Hi @jmac

In order to have custom claims added inside an access token, you will need to use a custom authorization server created through [API Access Management](https://developer.okta.com/docs/concepts/api-access-management/). Okta authorization server does not support custom access token claims.

When configuring the custom claim, the expression should be something like

```auto
user.tester == 'true' ? 'test.post' : null

```

---

<div class="post-metadata">

**Author:** ![jmac](https://avatars.discourse-cdn.com/v4/letter/j/258eb7/32.png) [@jmac](https://devforum.okta.com/u/jmac)\
**Post date:** [February 10, 2020, 5:32pm UTC](https://devforum.okta.com/t/api-scopes-based-on-user-profile-attribute/7991/3 "2020-02-10T17:32:17Z")

</div>

Thanks @dragos. Yes, that would work. But it’s unfortunate that I won’t be able to do the same with scopes, because scopes seem to directly be there for this purpose of indicating whether a given user has permissions to an API method or not.

In the expression, it would have to be something like below. Correct? Instead of using the scope ‘test.post’ (because the scope is available to anyone who requests for it from the specific client):

user.tester = ‘true’ ? user.role == “tester” : null

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 8:26pm UTC](https://devforum.okta.com/t/api-scopes-based-on-user-profile-attribute/7991/4 "2024-01-23T20:26:13Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.