DocumentationExperience Cloud KCS

Configuring OAuth scopes for exposing AEM GraphQL endpoints

Last update: September 9, 2026

This article explains how to configure OAuth scopes and permissions for Adobe Experience Manager (AEM) GraphQL endpoints. Incorrect scope configuration, missing persisted queries, or insufficient permissions can prevent external applications from accessing GraphQL endpoints through OAuth bearer tokens. To resolve the issue, Verify the GraphQL configuration, persisted queries, and OAuth scope assignments to ensure secure access.

Description description

Environment

Adobe Experience Manager (AEM) (all versions)

Issue/Symptoms

  • External applications cannot access AEM GraphQL endpoints by using OAuth bearer tokens.
  • Uncertainty exists about the OAuth scopes and privileges required for secure access to GraphQL endpoints and persisted queries.

Root Cause

Incorrect OAuth scope configuration, missing persisted queries, or custom implementations that do not grant the required permissions prevent access to AEM GraphQL endpoints.

Resolution resolution

Follow the steps below to resolve the issue:

  1. Verify that the GraphQL endpoint exists and is associated with the correct configuration under /conf/your-project.
  2. Ensure that Content Fragment Models and GraphQL Persistent Queries are enabled for the configuration.
  3. Confirm that the persisted query exists under /conf/your-project/settings/graphql/persistentQueries/yourQueryName.
  4. Verify that the persisted query endpoint follows the format /graphql/execute.json/your-project/yourQueryName.
  5. Review the custom ScopeWithPrivileges implementation, if applicable, and ensure that it grants the required permissions to access the GraphQL endpoint and persisted queries.
  6. Assign the appropriate OAuth scopes to the OAuth client in the AEM configuration and verify that the scopes provide access to the required endpoints and persisted queries.
  7. Test direct access to the GraphQL endpoint by using a bearer token and verify that access is granted.
  8. If custom Java code manages scopes or permissions, engage the development team to review and troubleshoot the implementation because custom code falls outside standard Adobe Support scope.
  9. Verify the resolution by accessing the GraphQL endpoint with a valid bearer token and confirming that the expected data is returned.
recommendation-more-help
experience-cloud-kcs-help-kbarticles