Scopes

The BTG Pactual Empresas systems handle security at the user level — that is, we use the permissions the user grants to decide what your system can access in that specific user's account.

At the same time, we need to know what your system has access to so that we can ensure the integrity of the services and increase end-user security.

To serve these two functions, we implemented what we call Scopes in our ecosystem.

openid

The openid scope is required for effectively all banking API services. Keep in mind that it must always be included in your flow.

Some specific cases, such as the client credentials flow, do not require this scope.

readonly

Scopes ending in .readonly are scopes that allow only read and listing methods.

Claim

In the authorization code flow, scopes of the form empresas.btgpactual.com/[resource] generate what we call a claim. A claim is a "piece" of information in the token that tells our system something. In this case, the generated claim tells us that the token allows access to a given resource at a given company.

The claim resulting from a scope in the format described above is "empresas.btgpactual.com/[resource]":"CNPJ" and indicates that the token has permission to access the specified resource in the account of the specified CNPJ.

The absence of a claim of this type, or the absence of the CNPJ, is the main cause of the 403 error. Visit Troubleshooting to find the solution for this scenario.