Scopes

Available scopes, the claims they return and how to use them.

A scope is a set of claims, or a journey option. Request the minimum needed for your use case: sensitive scopes require a justification in the access request.

Claims requested per scope are provided if available; otherwise they are absent and no error is raised. This list follows the implementation guide V2 (section 6.2); the guide prevails, and A3BC may adapt some behaviors for a given RP.

Base identity

The civil identity of a natural person, usually extracted from an official identity document.

Scope	Claims	Description
`profile`	`given_name, family_name, gender, birthdate`	Basic profile. This scope does not tell how the claims were verified.
`private:person` Sensitive	`given_name, family_name, gender, birthdate, private:birthplace, private:birthcountry, private:person_verified, private:nationality, private:married_name, private:person.credential.expiration`	Base identity attributes extracted from an official identity document.
`private:person.insee` Sensitive	`private:person + private:birthplace.insee, private:birthcountry.insee`	Adds the INSEE codes of the birthplace and birth country to private:person.

Other attributes

Scope	Claims	Description
`email`	`email, email_verified, private:email.credential.issuance, private:email.credential.expiration`	Email address. `email_verified` is true when it was verified by OTP.
`phone`	`phone_number, phone_number_verified, private:phone_number.credential.issuance, private:phone_number.credential.expiration`	Phone number. `phone_number_verified` is true when it was verified by OTP.
`address`	`address, private:address_details, private:address_verified, private:address.credential.issuance, private:address.credential.expiration`	Postal address of the user.
`private:bankaccount` Sensitive	`private:bankaccount, private:bankaccount_verified, private:bankaccount.credential.issuance, private:bankaccount.credential.expiration`	Bank account information.
`private:ssn.fr` Sensitive	`private:ssn, private:ssn_key, private:ssn_verified, private:ssn.credential.issuance, private:ssn.credential.expiration`	French social security number.

Documents

These scopes add claims containing the URL of a document, to retrieve with the document API. private:doc.* scopes give verified documents.

Scope	Claims	Description
`private:doc.id` Sensitive	`private:doc.id, private:doc.id.hash, private:person_verified`	Digital copy of the identity document used to verify the base identity.
`private:doc.address` Sensitive	`private:doc.address, private:doc.address.hash, private:address_verified`	Document used to verify the address.
`private:doc.bankaccount` Sensitive	`private:doc.bankaccount, private:doc.bankaccount.hash, private:bankaccount_verified`	Verified bank details document.
`private:doc.ssn` Sensitive	`private:doc.ssn, private:doc.ssn.hash, private:ssn_verified`	Document from which the social security number was extracted.
`private:doc.photo` Sensitive	`private:doc.photo, private:doc.photo.hash, private:photo_verified, private:photo.credential.issuance, private:photo.credential.expiration`	Only the user’s picture (matched with an official id).

Technical scopes

They control how the transaction runs.

Scope	Claims	Description
`openid`	—	Required. Returns a standard id_token including the requested claims.
`private:method.qrcode`	—	The user starts the consent through a QR code. May not be allowed for your Relying Party: the IdP then decides.
`private:method.identifier`	—	The user starts the consent through a login. May not be allowed for your Relying Party.
`private:delayed_sharing`	`private:delayed_sharing`	Enables delayed sharing: the claim returns the delayed sharing API URL. See the dedicated section.