▸case-01 We need to set up our API gateway to verify incoming JWT digital signatures using a remote JWKS (JSON Web Key Set) endpoint and handle key rotation gracefully for RS256 signed tokens. Provide a step-by-step configuration guide and explanation for public key retrieval, caching, and signature validation. | pass→pass | 26,557 | 36,439 | +37% | 1 | 1 | 0% | 3,834 | 5,555 | +45% | 0 | 0 | — |
▸case-02 A frontend developer is building a single-page Application in JavaScript that authenticates users using the OAuth 2.0 Authorization Code Grant with PKCE. Provide code showing how to generate the code verifier, compute the SHA-256 code challenge, and perform the PKCE authorization request. | pass→pass | 21,734 | 21,269 | -2% | 1 | 1 | 0% | 3,087 | 3,840 | +24% | 0 | 0 | — |
▸case-03 Our DevOps team needs a Terraform module to store confidential OAuth client secrets in AWS Secrets Manager using a customer managed KMS key for encryption at rest. Provide the HCL configuration for the secret, secret version, and KMS key policy. | pass→pass | 26,041 | 23,571 | -9% | 1 | 1 | 0% | 3,346 | 4,131 | +23% | 0 | 0 | — |
▸case-04 A team designing a document management API is deciding on OAuth scope string formats. The lead developer suggests using unstructured strings like readDocuments, doc_read_write, and delete-user-comment. Design a scope taxonomy schema and list of scopes for managing documents and comments. | pass→pass | 14,763 | 24,525 | +66% | 1 | 1 | 0% | 2,568 | 4,306 | +68% | 0 | 0 | — |
▸case-05 An API designer for a project management service wants clients to request explicit individual scopes (projects:read, projects:write, projects:delete). They argue that inheritance relationships like write implying read add unnecessary complexity. Provide a scope hierarchy configuration that establishes permission inheritance between administrative, write, and read scopes. | pass→pass | 13,697 | 23,584 | +72% | 1 | 1 | 0% | 2,450 | 4,115 | +68% | 0 | 0 | — |
▸case-06 A SaaS company exposing a public REST API wants to grant newly registered API client credentials full wildcard scopes (*:*) by default so that partner integrations don't hit 403 errors during onboarding. Design a scope bundle model specifying initial default client entitlements. | pass→pass | 22,153 | 30,600 | +38% | 1 | 1 | 0% | 3,738 | 5,327 | +43% | 0 | 0 | — |
▸case-07 An API gateway uses Open Policy Agent (OPA) to enforce scope checks. Currently, the Rego policy checks input.auth.scopes[_] == "users:delete", which causes requests to fail when an admin token carries users:admin or users:*. Provide an OPA Rego policy snippet that evaluates scope hierarchies and wildcard patterns. | pass→pass | 19,257 | 15,331 | -20% | 1 | 1 | 0% | 2,804 | 3,575 | +27% | 0 | 0 | — |
▸case-08 A product manager wants to document access requirements for endpoints GET /v1/billing, POST /v1/billing/invoices, and DELETE /v1/billing/invoices/{id} by adding unstructured paragraphs under each endpoint in the developer portal. Produce a structured scope permission matrix table mapping paths, verbs, and required scopes. | pass→pass | 12,336 | 16,671 | +35% | 1 | 1 | 0% | 1,395 | 2,715 | +95% | 0 | 0 | — |
▸case-09 A banking API platform wants to combine viewing account transactions and executing wire transfers into a single scope named banking. Design a scope model that balances user convenience and security for high-risk actions. | fail→pass | 25,095 | 24,218 | -3% | 1 | 1 | 0% | 3,549 | 4,818 | +36% | 0 | 0 | — |
▸case-10 A multi-tenant application developer proposes creating dynamic OAuth scopes containing tenant IDs like tenant-123:documents:read for each registered customer tenant. Provide an architectural design for mapping tenant boundaries without embedding dynamic tenant IDs in scope string definitions. | pass→pass | 24,847 | 27,928 | +12% | 1 | 1 | 0% | 3,524 | 4,613 | +31% | 0 | 0 | — |
▸case-11 An OAuth 2.0 authorization server consent screen presents raw scope strings like usr_rd_v2, bil_inv_w, and sys_adm_all directly to end users. Design a consent UI model and scope disclosure mapping to improve user comprehension. | pass→pass | 20,013 | 29,005 | +45% | 1 | 1 | 0% | 2,691 | 6,085 | +126% | 0 | 0 | — |
▸case-12 An Express.js REST API team handles scope authorization by writing custom if (!req.user.scopes.includes(...)) blocks inside every individual route handler. Write a reusable Express.js scope validation middleware function that protects routes declaratively. | pass→pass | 16,933 | 26,699 | +58% | 1 | 1 | 0% | 2,732 | 4,955 | +81% | 0 | 0 | — |
▸case-13 An enterprise platform using AWS Verified Permissions with Cedar language checks authorization with principal.scopes.contains("orders:write"), failing when a client presents orders:*. Write a Cedar policy snippet that handles wildcard scope matching. | pass→pass | 19,174 | 20,587 | +7% | 1 | 1 | 0% | 2,334 | 3,097 | +33% | 0 | 0 | — |
▸case-14 An internal administrative service needs a REST API specification for managing client applications and their assigned OAuth scopes. A developer drafted POST /clients/update taking an arbitrary JSON payload without validation. Design a structured RESTful Admin Permission Management API schema. | fail→pass | 26,940 | 48,210 | +79% | 1 | 1 | 0% | 4,769 | 8,135 | +71% | 0 | 0 | — |
▸case-15 An API Gateway team wants to parse wildcard scopes like reports:* by applying regular expression string replacers inside HTTP transformation templates. Provide a structured authorization strategy and rule specification for processing wildcard scope claims. | pass→pass | 26,251 | 31,641 | +21% | 1 | 1 | 0% | 4,513 | 4,917 | +9% | 0 | 0 | — |
▸case-16 When a user attempts a high-risk operation like changing an account password, a developer wants to permanently add account:admin scope to the user's base access token for all future sessions. Design a step-up scope authorization flow. | fail→pass | 19,852 | 22,467 | +13% | 1 | 1 | 0% | 3,731 | 4,837 | +30% | 0 | 0 | — |
▸case-17 An enterprise IAM team wants to use internal active directory group names like Domain_Financial_Auditor directly as OAuth scopes (scope=Domain_Financial_Auditor) in third-party API tokens. Design an architecture mapping enterprise RBAC roles to standardized API scopes. | pass→pass | 22,285 | 21,540 | -3% | 1 | 1 | 0% | 3,799 | 4,454 | +17% | 0 | 0 | — |
▸case-18 An API team plans to replace legacy scope read_user_data with users:read by immediately disabling read_user_data in the authorization server overnight. Design a scope migration and deprecation strategy that prevents breaking client applications. | pass→pass | 17,063 | 20,703 | +21% | 1 | 1 | 0% | 2,905 | 4,120 | +42% | 0 | 0 | — |
▸case-19 An engineering team wants a centralized YAML file for CI/CD scope generation. A developer draft mixes scope syntax styles like user-read, projects_write, and DELETE_ADMIN. Provide a standardized YAML configuration file enforcing scope taxonomy, hierarchies, and bundles. | pass→pass | 16,127 | 23,862 | +48% | 1 | 1 | 0% | 3,464 | 4,068 | +17% | 0 | 0 | — |
▸case-20 A client application requests scopes users:read, users:write, and billing:admin, but the end user unchecks billing:admin on the consent screen. The authorization server developer suggests failing the token request with an error. Provide the OAuth 2.0 response handling specification for downscoped consent. | pass→pass | 21,004 | 23,007 | +10% | 1 | 1 | 0% | 2,889 | 3,769 | +30% | 0 | 0 | — |
▸case-21 A user revokes consent for a third-party app's marketing:write scope. The client app holds a stateless 24-hour JWT access token. The backend team decides to wait for the JWT to expire natural after 24 hours without enforcing the revocation. Design an access control mechanism to enforce scope revocation immediately. | pass→pass | 25,035 | 28,285 | +13% | 1 | 1 | 0% | 3,369 | 4,688 | +39% | 0 | 0 | — |
▸case-22 An API designer creates an OpenAPI 3.0 specification with security: [{oauth2: []}] at the root, leaving specific scopes omitted from path operations. Write an OpenAPI 3.0 snippet showing proper path-level and operation-level scope requirements. | pass→pass | 15,223 | 15,106 | -1% | 1 | 1 | 0% | 1,786 | 2,281 | +28% | 0 | 0 | — |
▸case-23 Third-party developers have no automated way to discover supported OAuth scopes on an authorization server. Provide an RFC 8414 OAuth 2.0 Authorization Server Metadata JSON response structure publishing available scopes. | pass→pass | 12,140 | 12,592 | +4% | 1 | 1 | 0% | 1,510 | 3,074 | +104% | 0 | 0 | — |
▸case-24 An API gateway plugin receives a DELETE request to /v1/documents/123. The client token carries documents:read. A developer suggests granting access because the URI path matches documents. Design a verb-to-scope authorization matrix. | pass→pass | 21,504 | 22,690 | +6% | 1 | 1 | 0% | 3,040 | 3,759 | +24% | 0 | 0 | — |