If you make a request without a token (or with an insufficient token), the resource can respond with the required scopes. As in: WWW-Authenticate: Bearer realm

If you make a request without a token (or with an insufficient token), the resource can respond with the required scopes. As in: WWW-Authenticate: Bearer realm="example", error="insufficient_scope", scope="view_topic" In terms of a map of what scopes are required for all resources on a site - unfortunately just like other non-RESTful things that is conveyed outside of the interactions today via something like OpenAPI descriptors and documentation. The AS can convey a list of requestable scopes in its metadata. There were specs like host_meta which could have been easily leveraged to do the same for a resource server, but I am not sure host_meta actually went anywhere.