I have several client scopes defined in the realm, and some roles.
“Scope” in my domain means a specific permission, such as “entity.create”, “entity.view”, “entity.delete”, etc. “Role” means an aggregation of permissions that will be assigned to the user, such as “Administrator”, “Line operator”, “Guest”, etc.
For example, the “Guest” role will be mapped to just “entity.view” scope, the “Administrator” role will be mapped to “entity.view”, “entity.create” and “entity.delete” scopes.

Now I need to get the list of the scopes assigned to a specific role, for example the “Guest”, to present it in the frontend and allow the user to map new scopes or remove mapped scopes.

There’s a keycloak endpoint to receive this list? In my understanding, the only way to get this information is to get the entire list of the client scopes using GET /admin/realms/{realm}/client-scopes, and then iterate on each scope id using GET /admin/realms/{realm}/client-scopes/{client-scope-id}/scope-mappings/clients/{client} to check if the role is in the mapped roles. But this is totally inefficient…

I’m struggling with this for a while now… I hope there’s a solution.

Thank you all.

Copilot suggested me to use the endpoint GET admin/realms/{realm}/clients/{client-id}/scope-mappings, but this endpoint seems to return just the mapping between the client and the roles, and there’s no reference to the scopes (despite the endpoint name…)