API Gateway Platform · View 21 of 21 · Assurance
The point of the page
- A 403 that names the scope it wanted is the difference between a fix and a support ticket. The platform knows the answer; withholding it buys no security against an attacker who can enumerate anyway.
- Both the denial and the allow are written to the audit ledger. A control that records only failures cannot answer "what did this credential do before we revoked it?".
- Scope authorisation is per route, so a read credential cannot reach a write route even when the tenant is subscribed to the product.
Assumptions
- Introspection is a cache refill, not a hot-path call; the cache TTL is 5 minutes (assumption).
- Scope names are part of the published API contract and are versioned with the product.
Risks
- Naming the required scope leaks the existence of routes a caller is not entitled to. Judged acceptable here because the API surface is published documentation; it would not be acceptable for an internal API with a confidential surface.
