Get API Product Scopes

[dhoenig23]

How do I get the allowed scopes for the API Products for a given proxy? I'd like to do this in the Proxy PreFlow when a request comes in. 

[ssvaidyanathan]

@dhoenig23 - When you use VerifyAccessToken operation using an OAuth policy, it should populate a "scope" flow variable with the scopes associated with that validated token. You can then check for fine grained access controls by inspecting that scope variable against your logic using conditions

[API-Evangelist]

You question is little open ended but if you just looking to know the scopes for a given product...There are different ways but why not use AccessEntity to pull information about the product.

https://docs.apigee.com/api-platform/reference/policies/access-entity-policy

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AccessEntity async="false" continueOnError="false" enabled="true" name="AE-APIProduct">
<DisplayName>AE-APIProduct</DisplayName>
<Properties/>
<EntityIdentifier ref="productName"/>
<EntityType value="app"/>
<EntityType value="apiproduct"/>
</AccessEntity>

It will give the information  related to scopes - AccessEntity.AE-APIProduct.ApiProduct.Scopes.Scope  & later you can actual match with the formparam say -  request.formparam.scope & decide on next steps..