Scopes Table used in LTI Advantage tools?

Hi Bhoomika,

Thank you for the answer. I think the scopes that you are suggesting me can be used when you have a tool that is registered as an OAuth 2.0 application and you use the 'authorization_code' approach to obtain the access token. But this is not my case.

I might be wrong but based on my experiences it seems to me that when the tool is registered as an LTI Advantage and we are using the 'client_credentials' approach to obtain the access token, then we have to use the security scopes that follow the IMS Global (1EdTech) standards: https://www.imsglobal.org/spec/security/v1p0/#h_scope-naming-conventions

As an example, the following code successfully gives me an access token. It authorizes my user with such scopes that give me access to an array of line items if I call the `https://${instance}.brightspace.com/d2l/api/lti/ags/2.0/deployment/${deploymentId}/orgunit/${orgUnit}/lineitems` endpoint.

const payload = {

      grant_type: 'client_credentials',

      client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',

      client_assertion: token, // (*)

      scope: [

        'https://purl.imsglobal.org/spec/lti-ags/scope/score',

        'https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly',

        'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem',

      ].join(‘ ’)

};

const accessTokenResponse = await fetch('https://auth.brightspace.com/core/connect/token', {

      method: 'POST',

      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },

      body: new URLSearchParams(payload),

});

/* (*)

      The token contains the followings in its payload:

      {

            iss: clientId,

            sub: clientId,

            aud: 'https://api.brightspace.com/auth/token',

            iat: now,

            nbf: now,

            jti: crypto.randomBytes(16).toString('hex'),

      };

*/

But my problem is that I am not interested in these line items. I would like to be able to call other endpoints for which I need to have my user be authorized with those scopes that are required by those endpoints. But it is really difficult to figure out what scopes I need for which endpoint.

I hope you will find the above explanation helpful.