vc-http-api scopes

scopes.md

components:
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://example.com/oauth/authorize
          tokenUrl: https://example.com/oauth/token
          scopes:
            'create:credentials': Grants permission to create credentials
            'derive:credentials': Grants permission to derive credentials
            'create:presentations': Grants permission to create presentations
            'verify:presentations': Grants permission to verify presentations
            'exchange:presentations': Grants permission to exchange presentations   

actions: [ create, derive, verify, exchange ]
datatypes: [ credentials, presentations ]

const accessToken = await getAccessTokenSilently({
    audience: `https://${domain}/api/v2/`,
    scope: "create:credentials",
});

what does the RAR version of this look like?

You're no longer comparing protocols, you're comparing libraries. So, making up a function syntax, it would be something like:

const accessToken = await getAccessTokenSilently({
    audience: `https://${domain}/api/v2/`,
    action: "create",
    datatype: "credentials"
});

This would result in a RAR request something like (assuming "example.com" for the $domain variable above):

[{
    "type": "vha",
    "locations": [ "https://example.com/api/v2/" ],
    "actions": ["create"],
    "datatypes": ["credentials"]
}]

vha being vc-http-api or whatever it ends up being called I'm guessing. Would this type be defined somewhere, what's the significance of it?

Edit reading your e-mail on the mailing list now which I believe clears this up

The type parameter in RAR/GNAP defines what else is allowed to go into the object. Here vha being a stand-in for something more like https://w3c.org/ccg/vh-http-api, to be defined by the spec. It's a namespacing device, and a URL is used there to avoid conflicts. It's not expected to download or mechanically process what's at the URL, it's just to keep it out of other people's spaces. This spec could use vha but it's not recommended because the Virtual Hats API could also try to use vha and that would be confusing. :)