# rich-authorization-requests

Source: https://startwithidentity.com/glossary/rich-authorization-requests/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

OAuth 2.0 Rich Authorization Requests (RAR, [RFC 9396](https://www.rfc-editor.org/rfc/rfc9396), Proposed Standard, May 2023) add an `authorization_details` parameter that lets a client request structured, fine-grained permissions as JSON objects, for example "pay 123.50 EUR to this account", instead of flat scope strings.

Scopes describe a category of access and cannot express amounts, specific records, or one-time actions, which is why payment and health APIs kept inventing their own extensions. RAR gives each request a `type` plus whatever fields that type needs (actions, locations, datatypes, identifiers), the authorization server shows them on the consent screen, and the granted details come back in the token response and the access token or introspection response. The RFC's own examples are payment initiation and account access, it is used alongside FAPI 2.0 in open banking, and it is a natural fit for AI agents that should be authorized for one purchase or one document rather than a standing scope. The cost is complexity: every resource server has to parse and enforce the detail types it accepts.

See also: [scope](https://startwithidentity.com/glossary/scope/), [FAPI](https://startwithidentity.com/glossary/fapi/), [fine-grained authorization](https://startwithidentity.com/glossary/fga/), [PAR](https://startwithidentity.com/glossary/par/), [PSD2](https://startwithidentity.com/glossary/psd2/), [FAPI standard](https://startwithidentity.com/standards/fapi/), [agentic identity](https://startwithidentity.com/glossary/agentic-identity/)