Skip to content

Invalid Scope

URI: https://docs.ankatech.co/errors/invalid_scope
HTTP Status: 400 Bad Request

This error also corresponds to the RFC 6749 OAuth 2.0 error code invalid_scope of the same name. The RFC 9457 type suffix uses the identical underscore form so the two identifiers match.

When you see this

The requested scope is unknown, malformed, or exceeds the scope the client or resource owner may be granted.

Common Causes

  • Requesting a scope that does not exist.
  • A malformed scope string.
  • Requesting a scope beyond what the client or resource owner is allowed.

Response Example

{
  "error": "invalid_scope",
  "error_description": "The requested scope is invalid or exceeds the permitted scope.",
  "error_uri": "https://docs.ankatech.co/errors/invalid_scope",
  "type": "https://docs.ankatech.co/errors/invalid_scope",
  "title": "Invalid Scope",
  "status": 400,
  "detail": "The requested scope is invalid or exceeds the permitted scope.",
  "instance": "/api/v3/auth/token",
  "timestamp": 1730000000
}

Content-Type: application/json — not application/problem+json. RFC 6749 §5.2 defines the token endpoint's error response, and the Auth API emits that shape deliberately: the RFC 9457 members ride along for clients that read them, but no RFC 9457 media type or envelope is emitted on this endpoint. Switch on the status and the error member, never on the media type.

The Auth API carries no correlation member in the body: correlate through the X-Correlation-Id response header instead. See Error Index & Overview.

How to Resolve

  1. Request only scopes that exist and that the client is permitted to obtain.
  2. Check scope names and formatting against the Developer Hub Reference.
  3. Re-submit with a valid scope set.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.