The application requesting to create a new user does not need a specific scope.

The statement is false. In Genesys Cloud CX, all API operations are governed by a role-based access control (RBAC) model. Creating a new user is an administrative action that requires specific authorization. An application, acting as an OAuth client, must be configured with a role that includes the directory:user:add permission. When the application makes an API request to the POST /api/v2/users endpoint to create a user, Genesys Cloud validates that the OAuth token used has the necessary permissions. Without this specific permission, the API call will fail with a "403 Forbidden" error, enforcing the principle of least privilege.

A. True: This is incorrect. Genesys Cloud's security model mandates that any application performing administrative tasks, such as user creation, must be explicitly granted the corresponding permissions to prevent unauthorized actions.

1. Genesys Cloud CX Developer Center, Platform API Documentation: Under the "Users" section, the documentation for the POST /api/v2/users endpoint explicitly lists the required permission.

Reference: Required permission: directory:user:add

Source: Genesys Cloud CX Developer Center, API Explorer, Users, POST /api/v2/users.

2. Genesys Cloud CX Resource Center, About roles and permissions: This document outlines the fundamental security concept that actions are controlled by permissions assigned to roles, which are then assigned to users or OAuth clients.

Reference: The section "Permissions" explains that "Permissions authorize users to perform tasks... Genesys Cloud denies access to anyone who attempts to perform a task for which they do not have permission."

Source: Genesys Cloud CX Resource Center, "About roles and permissions" article.

3. Genesys Cloud CX Developer Center, Authorization: This documentation details how applications (OAuth clients) are authorized. It specifies that a client must be assigned a role with the necessary permissions to access API resources.

Reference: The "Client Credentials Grant" section explains that the access token is associated with the permissions granted to the OAuth client's role.

Source: Genesys Cloud CX Developer Center, "Authorization" guide.