Controls
Last updated
Last updated
Controls are power-holding assets that accounts can obtain and grant to others. We currently have two types of controls we support:
Scopes representing API access as defined as part of the OAuth 2.0 standard. Once an access token is issued it will generally hold a scope claim containing the granted scopes. The API will then inspect the scopes it contains and make an access decision. Hence it's key to understand meaning and enforcement happens at the API and not within Quasr. Scopes are generally just a string but we recommend a fully-qualified approach (so https://example.com/xyz).
Legal controls represent acceptance of legal terms such as service Terms & Conditions, or any other documents or statements. Also legal controls are generally just strings but again here we recommend a fully-qualified approach where you could refer to a web page containing the text. As you'll notice legal controls are processed differently.
In your tenant you'll find three pre-provisioned controls:
Account Access (https://api.quasr.io/scopes/account) which provides access to an account own resources such as enrollments, consents, etc. via the Management API.
Admin Access (https://api.quasr.io/scopes/admin) which provides privileged access to the Management API though not all actions on other accounts are allowed to protect overall security and privacy guarantees.
OpenID Connect 1.0 (openid) which provides clients an identity token, on top of the standard OAuth 2.0 access token. It also provides access to an UserInfo endpoint though we currently don't provide this endpoint.
see
see
