I have several client scopes defined in the realm, and some roles.
“Scope” in my domain means a specific permission, such as “entity.create”, “entity.view”, “entity.delete”, etc. “Role” means an aggregation of permissions that will be assigned to the user, such as “Administrator”, “Line operator”, “Guest”, etc.
For example, the “Guest” role will be mapped to just “entity.view” scope, the “Administrator” role will be mapped to “entity.view”, “entity.create” and “entity.delete” scopes.

I have several client scopes defined in the realm, and some roles.
“Scope” in my domain means a specific permission, such as “entity.create”, “entity.view”, “entity.delete”, etc. “Role” means an aggregation of permissions that will be assigned to the user, such as “Administrator”, “Line operator”, “Guest”, etc.
For example, the “Guest” role will be mapped to just “entity.view” scope, the “Administrator” role will be mapped to “entity.view”, “entity.create” and “entity.delete” scopes.

I am using keycloak 24/25.

Im Using PythonKeycloak to use Keycloak API.

I’m looking for advice on managing roles and policies for API authentication.

So Keycloak has this admin api:
https://www.keycloak.org/docs-api/22.0.1/rest-api/index.html#_overview