Cloud Identity Devices Scopes

[Bekkah]

Hi,

I am trying to authenticate to the auth/cloud-idenity.devices and/or the auth/cloud-identity found here.

But I keep getting the message:
"You are receiving this error either because your input OAuth2 scope is invalid or it refers to a newer scope that is outside the domain of this legacy API.
This API was built at a time when the scope name format was not yet standardized. This is no longer the case and all valid scope names (both old and new) are catalouged at https://developers.google.com/identity/protocols/oauth2/scopes. Use that webpage to lookup (manually) the scope name associated with the API you are trying to call and use it to craft your OAuth2 request."

And when I try to add it to the scope for my OAuth consent screen it is not listed and says the scope is invalid. 

I can see in the link from the oauth2/scopes site about that the auth/cloud-identity scope is not there but there is a devices.lookup scope.  

However, auth/cloud-identity.devices is listed as a scope in the OAuth Playground, but I can't authenticate to that scope.

Is this scope no longer available for use or retired? I am trying to use a low code platform to automate devices being added to the Google Corporate Device list.

Thank you so much for any direction in advanced.

Best,
Bekkah

[Marramirez]

Hi @Bekkah,

Welcome to the Google Cloud Community!

It seems that the OAuth 2.0 playground still contains APIs that are changed/deprecated in OAuth 2.0 Scopes. It is best to reference OAuth 2.0 scopes for Google APIs in this documented list.

It is worth looking into Control API access with domain-wide delegation to grant internal applications access to your data. In here, you can create service accounts with OAuth 2.0 to access supported Google APIs

Let me know if it helped, thanks!

[bpanday]

Hello,  attempting to implement cloud-identity devices but facing similar issue to yours, were you able to find a solution ? 

[ChandlerOnda]

Hello!

I am also facing some trouble when making a GET request to the `https://cloudidentity.googleapis.com/v1/devices` service endpoint.  The scopes listed in the documentation fail with 400 error when provided as part of an OAuth 2.0 consent URL, however they're accepted when I provide them in the body of a request to the STS token endpoint it proceeds without an error.

The trouble I am facing now, is that the token issued from the STS service with that scope does not seem to have permissions.  When I make a request to the `https://cloudidentity.googleapis.com/v1/devices` I am met with a 403 (The caller does not have permission).  As a sanity check, I even set the service account to have the 'Owner' role on the target organization, but I still get the same 403.

I am wondering whether this is related to the Google Workspace license, perhaps this service is only available for enterprise licenses?