# Authorization

The following table lists the operations of the signing identity management API. For each operation, the value is specified that must be contained by the scope of the access token that is inserted in the operation request message for the requesting application to perform the operation. This indication is made by specifying the type of OAuth flow via which the access token must be obtained (ACG, authorization code grant, or CCG, client credentials grant).

Operation \ Scope | manage | profile | credentials | register | permissions | sign | Observations
Create a Signing Identity on a Mobile Device |  |  |  | ACG |  |  | The registration scope must be the mobile signing identity registration scope of the schema to which the identity belongs.
Create a Signing Identity and its Associated Keys on the Server |  |  |  | ACG |  |  | The registration scope can be any server signing identity registration scope of the schemas registered in the TRIDENT.
Create a Signing Identity on Server from a PKCS #12 |  |  |  | ACG |  |  | The registration scope must be the server signing identity registration scope of the schema to which the identity belongs.
Update a Signing Identity |  |  |  | ACG, CCG |  |  | The registration scope must be the server signing identity registration scope of the schema to which the identity belongs.
Enable or Disable a Signing Identity | CCG |  |  |  |  |  |
Update the Activation Password of a Server Signing Identity in the HSM |  |  | ACG |  |  |  |
Obtain User Signing Identities | ACG, CCG | ACG, CCG |  | ACG, CCG |  |  | The registration scope can be any server signing identity registration scope of the schemas registered in the TRIDENT.
Obtain Signing Identity Information | ACG, CCG | ACG, CCG |  | ACG, CCG |  |  | The registration scope must be the server or mobile signing identity registration scope of the schema to which the identity belongs.
Delete a Signing Identity | ACG, CCG |  |  | ACG, CCG |  |  | The registration scope must be the server or mobile signing identity registration scope of the schema to which the identity belongs.
Obtain Information on Access Permissions to a Signing Identity | ACG | ACG |  | ACG | ACG |  |
Obtain Information on a User's Access Permissions to a Signing Identity | ACG | ACG |  | ACG | ACG |  |
Update Access Permissions to a Signing Identity |  |  |  |  | ACG | ACG |
Update a User's Access Permissions to a Signing Identity |  |  |  |  | ACG | ACG |

In operations in which multiple values are specified, the scope only needs to contain one of the values. The values specified are abbreviations of the following values (which are the values that the scope must contain):

- manage: `urn:safelayer:eidas:sign:identity:manage`.

- profile: `urn:safelayer:eidas:sign:identity:profile`.

- credentials: `urn:safelayer:eidas:sign:identity:manage:server:credentials`.

- register: mobile or server signing identity registration scope. For example, `urn:safelayer:eidas:sign:identity:register`.

- permisions: `urn:safelayer:eidas:sign:identity:manage:permissions`.

- sign: `urn:safelayer:eidas:sign:identity:manage:permissions:sign`.