Protected resources define the services that clients can access and the scopes available for those services.

To manage protected resources, go to Policies > Protected resources.

The page contains two tabs:

• Delegated access: Configure protected resources that OAuth2/OIDC clients can request access to as part of an authorization journey.
• System access: Configure authorization for proprietary REST APIs and backend services. System access replaces the previous API security policy configuration.

Delegated access

Delegated access policies define protected resources that OAuth2/OIDC clients can request access to on behalf of customers.

A delegated access policy identifies the protected resource, the scopes it supports, and the customer-facing information Strivacity can display when authorization is required.

Create a delegated access policy

1. Go to Policies > Protected resources.
2. On the Delegated access tab, select Create.
3. Enter a Name and, optionally, a Description.
4. Optionally, assign a Policy tag to help organize your policies.
5. Select the protected resource Type.
   1. Generic protected resource: An API or other OAuth2-protected service.
   2. MCP server: A Model Context Protocol server.
6. Enter the Display name and Logo URL. These identify the resource to customers when authorization is required.
7. Enter the Resource URL. This identifies the protected resource in authorization requests and issued access tokens.
8. Select Save.

Protected resources with the MCP server type are also listed under Agentic AI > MCP servers.

Define scopes

Scopes describe the permissions that clients can request for the protected resource.

1. Open the delegated access policy.
2. Select the Scopes tab.
3. Select Create scope.
4. Enter:
   1. Name: The technical scope value requested by the client.
   2. Display name: The customer-facing description of the permission.
5. Select Save.

Save the new scope and repeat the steps until you've added every desired scope.

At this point, the protected resource and its scopes are not available to a client yet. Assign the protected resource to the client that should be allowed to request access.

Assign the protected resource to a client

1. Go to Applications and open the application.
2. Open the OAuth2/OIDC client that should have access to the resource.
3. Select the Protected resources tab.
4. Select Assign protected resource.
5. Select the protected resource.
6. Select the scopes you want to allow the client to request.
7. Configure whether customer authorization is required for the applicable scopes.
8. Select Save.

The scopes selected in the assignment define which permissions the client can request. The client does not need to request every scope assigned to it.

When authorization is required, Strivacity presents the requested access to the customer during the authorization journey.

See Authorization consents for more information about the customer authorization experience.

Disable a delegated access policy

You can disable a protected resource without deleting its configuration.

Disabling a protected resource:

• It cannot be used for new authorization requests.
• Token refresh for the protected resource is prevented.
• Its configuration remains available.
• The protected resource and its scope configuration remain visible in client assignments as disabled.
• Related authorization consents remain visible as disabled.
• Customers and administrators can still remove disabled authorization consents.

Re-enable the protected resource to make it available for authorization again.

Delete a delegated access policy

Deleting a protected resource removes its configuration and removes it from client assignments.

Existing authorization consents remain available but indicate that access has been removed. Customers and administrators can remove these remaining consent records.

Protected resource disable and delete operations are recorded in the audit log.

System access

Set up authorization for your proprietary REST APIs or backend services through Strivacity.

System access allows you to expose your REST APIs' endpoints and custom scopes to Strivacity's API Controller service.

Strivacity's API Controller will:

• Generate and provide access tokens for use against your REST APIs.
• Allow access to the scopes defined in the system access policy.
• Allow your proprietary REST APIs to validate access tokens.

Client credentials flow

Strivacity provides API authorization using the Client Credentials flow that starts with an access token request.

You can obtain the credentials (Client ID and Client Secret) needed for the token request from an application.

Create a system access policy

1. Go to Policies > Protected resources.
2. Select the System access tab.
3. Select Create.
4. Enter a Name and, optionally, a Description.
5. Optionally, assign a Policy tag to help organize your policies.
6. Enter the Audience.
7. Select Save.

Define scopes

1. Open the system access policy.
2. Switch to the Scopes tab, where you can add your REST API's scopes.
3. Select Create scope to fill in a scope.
4. Save your new scope and repeat the steps until you've added every desired scope.

Assign the policy to a client

1. Open the system access policy.
2. Continue to Client assignments and select Assign to client.
3. Assign the application that will provide the Client ID and Secret for the communication between the Strivacity API Controller and your REST API.
4. Select the scopes you want to allow access to.
5. Save your changes.