# Coarse-grained scope in ID token to fine-grained API permission **URL:** \ **Category:** Get Help\ **Tags:** user-profile, user-management\ **Created:** [May 3, 2024, 3:57pm UTC](https://community.auth0.com/t/coarse-grained-scope-in-id-token-to-fine-grained-api-permission/133346 "2024-05-03T15:57:41Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![darrenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/darrenk/32/56850_2.png) [@darrenk](https://community.auth0.com/u/darrenk)\ **Post date:** [May 3, 2024, 3:57pm UTC](https://community.auth0.com/t/coarse-grained-scope-in-id-token-to-fine-grained-api-permission/133346/1 "2024-05-03T15:57:41Z")
Hi, My API has a large number of fine-grained permissions. Based on [the Permissions, Privileges, and Scopes blog post](https://auth0.com/blog/permissions-privileges-and-scopes/) and other references I understand that I do not want to include the entire list of permissions in the scope. Ideally I would like to have coarse-grained “roles” - reader, writer, admin - in the scope, then _somewhere_ map those roles to fine-grained permissions and include those in the access token. What is the best practice around mapping coarse-grained roles to fine-grained permissions and validating an access token against an API call’s required permissions? Should the access token contained the list o fine-grained privileges? Or is this mapping handled outside of the authorization flow? As Auth0 provides Roles that map to a set of Permissions it seems like I should be able to make use of that during the user login flow. Thanks. ---
**Author:** ![darrenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/darrenk/32/56850_2.png) [@darrenk](https://community.auth0.com/u/darrenk)\ **Post date:** [May 3, 2024, 4:03pm UTC](https://community.auth0.com/t/coarse-grained-scope-in-id-token-to-fine-grained-api-permission/133346/2 "2024-05-03T16:03:37Z")
(For some reason - I asked [here](https://community.auth0.com/t/cant-select-relevant-tags-in-my-community-posts/133348) - I am unable to put relevant tags on my posts. This one needs `rbac`, `roles`, `scope`, `permissions`, …) ---
**Author:** ![marcelina.barycka](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/marcelina.barycka/32/56162_2.png) [@marcelina.barycka](https://community.auth0.com/u/marcelina.barycka)\ **Post date:** [May 6, 2024, 3:13pm UTC](https://community.auth0.com/t/coarse-grained-scope-in-id-token-to-fine-grained-api-permission/133346/5 "2024-05-06T15:13:24Z")
Hey @darrenk ! Generally speaking, regarding API authorization, the Auth0 Identity Provider will issue a JWT access token containing the `scope` claim. The scope claim content is the _intersection_ of: -scopes requested by the client application with the [/authorize](https://auth0.com/docs/api/authentication#login) request by specifying the `scope` query parameter and -the user’s assigned permissions within the IdP (assigned directly to the user, or using Roles). 🙂 Your API performs a standard JWT access token validation and later checks the `scope` claim to see if it matches the permissions required for the endpoint being accessed. Take a look here: [Validate Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/validate-access-tokens). > [@darrenk](#): > > My API has a large number of fine-grained permissions. These will have to be listed in the API settings in your Auth0 tenant: ![image](https://global.discourse-cdn.com/auth0/original/3X/c/6/c66777ac69c948bb19572d7057453cef7cf43fe6.png) > [@darrenk](#): > > What is the best practice around mapping coarse-grained roles to fine-grained permissions and validating an access token against an API call’s required permissions? The best practice for mapping is using Roles (Auth0 tenant → User Management → Roles). ![image](https://global.discourse-cdn.com/auth0/original/3X/5/0/505fe7f59c0c1efc2dcb490c2d9bf55e1c66bc10.png) The calling application should specify the scope needed. Auth0 IdP checks if the role assigned to the user covers the scopes requested. The `scope` claim returned in the access token should then be evaluated on the API side: does it contain all the permissions required to call the endpoint? Does this clear the topic? Please let me know your thoughts or follow-up questions! 🤠 ---
**Author:** ![darrenk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/darrenk/32/56850_2.png) [@darrenk](https://community.auth0.com/u/darrenk)\ **Post date:** [May 6, 2024, 3:55pm UTC](https://community.auth0.com/t/coarse-grained-scope-in-id-token-to-fine-grained-api-permission/133346/6 "2024-05-06T15:55:31Z")
This does provide a lot more clarity. Your response along with [this answer](https://community.auth0.com/t/permissions-privileges-and-scopes/74076/9) has cleared up my confusion around scopes, roles, and permissions. Thank you @marcelina.barycka -Darren ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [May 20, 2024, 3:55pm UTC](https://community.auth0.com/t/coarse-grained-scope-in-id-token-to-fine-grained-api-permission/133346/7 "2024-05-20T15:55:51Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.