From a1c410dd8c8cedf99502f3dd629c369100f7e7ba Mon Sep 17 00:00:00 2001
From: hwupathum <46132469+hwupathum@users.noreply.github.com>
Date: Thu, 18 Jun 2026 10:50:51 +0530
Subject: [PATCH 1/2] Admin API scopes

---
 .../resources/system-api-resource.xml         | 20 +++++++
 .../resources/system-api-resource.xml.j2      | 20 +++++++
 .../resources/resource-access-control-v2.xml  | 54 ++++++++++++++++---
 .../resource-access-control-v2.xml.j2         | 54 ++++++++++++++++---
 4 files changed, 136 insertions(+), 12 deletions(-)

diff --git a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml
index 5a3e7dbfebd8..f23b1438beb9 100644
--- a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml
+++ b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml
@@ -1012,6 +1012,16 @@
                    description="Delete Consent Purpose"/>
         </Scopes>
     </APIResource>
+    <APIResource name="Consent Management V2 Consents API" identifier="/api/identity/consent-mgt/v2.0/consents"
+                 requiresAuthorization="true"
+                 description="API representation of the Consent Management V2 Consents API" type="TENANT">
+        <Scopes>
+            <Scope displayName="View Consent" name="internal_consent_mgt_consent_view"
+                   description="View Consents"/>
+            <Scope displayName="Create Consent" name="internal_consent_mgt_consent_create"
+                   description="Create new Consent"/>
+        </Scopes>
+    </APIResource>
     <APIResource name="Consent Management V2 Elements API" identifier="/o/api/identity/consent-mgt/v2.0/elements"
                  requiresAuthorization="true"
                  description="API representation of the Consent Management V2 Elements API for organizations" type="ORGANIZATION">
@@ -1038,6 +1048,16 @@
                    description="Delete Consent Purpose in the organization"/>
         </Scopes>
     </APIResource>
+    <APIResource name="Consent Management V2 Consents API" identifier="/o/api/identity/consent-mgt/v2.0/consents"
+                 requiresAuthorization="true"
+                 description="API representation of the Consent Management V2 Consents API for organizations" type="ORGANIZATION">
+        <Scopes>
+            <Scope displayName="View Consent" name="internal_org_consent_mgt_consent_view"
+                   description="View Consents in the organization"/>
+            <Scope displayName="Create Consent" name="internal_org_consent_mgt_consent_create"
+                   description="Create new Consent in the organization"/>
+        </Scopes>
+    </APIResource>
     <APIResource name="Consent Purpose Application Mapping API"
                  identifier="/api/server/v1/configs/consent/purposes"
                  requiresAuthorization="true"
diff --git a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2 b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
index bb055b386676..a7b2bfea2ece 100644
--- a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
+++ b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
@@ -1008,6 +1008,16 @@
                    description="Delete Consent Purpose"/>
         </Scopes>
     </APIResource>
+    <APIResource name="Consent Management V2 Consents API" identifier="/api/identity/consent-mgt/v2.0/consents"
+                 requiresAuthorization="true"
+                 description="API representation of the Consent Management V2 Consents API" type="TENANT">
+        <Scopes>
+            <Scope displayName="View Consent" name="internal_consent_mgt_consent_view"
+                   description="View Consents"/>
+            <Scope displayName="Create Consent" name="internal_consent_mgt_consent_create"
+                   description="Create new Consent"/>
+        </Scopes>
+    </APIResource>
     <APIResource name="Consent Management V2 Elements API" identifier="/o/api/identity/consent-mgt/v2.0/elements"
                  requiresAuthorization="true"
                  description="API representation of the Consent Management V2 Elements API for organizations" type="ORGANIZATION">
@@ -1034,6 +1044,16 @@
                    description="Delete Consent Purpose in the organization"/>
         </Scopes>
     </APIResource>
+    <APIResource name="Consent Management V2 Consents API" identifier="/o/api/identity/consent-mgt/v2.0/consents"
+                 requiresAuthorization="true"
+                 description="API representation of the Consent Management V2 Consents API for organizations" type="ORGANIZATION">
+        <Scopes>
+            <Scope displayName="View Consent" name="internal_org_consent_mgt_consent_view"
+                   description="View Consents in the organization"/>
+            <Scope displayName="Create Consent" name="internal_org_consent_mgt_consent_create"
+                   description="Create new Consent in the organization"/>
+        </Scopes>
+    </APIResource>
     <APIResource name="Consent Purpose Application Mapping API"
                  identifier="/api/server/v1/configs/consent/purposes"
                  requiresAuthorization="true"
diff --git a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
index 9d5d1a128bad..572249e33cea 100644
--- a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
+++ b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
@@ -360,9 +360,30 @@
         <Scopes>internal_org_consent_mgt_purpose_update</Scopes>
     </Resource>
 
-    <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST"/>
-    <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET"/>
-    <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET"/>
+    <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST">
+        <Scopes>internal_login</Scopes>
+        <Operations mandatory="true">
+            <Operation name="createConsent">
+                <scope>internal_org_consent_mgt_consent_create</scope>
+            </Operation>
+        </Operations>
+    </Resource>
+    <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET">
+        <Scopes>internal_login</Scopes>
+        <Operations mandatory="true">
+            <Operation name="viewConsent">
+                <scope>internal_org_consent_mgt_consent_view</scope>
+            </Operation>
+        </Operations>
+    </Resource>
+    <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET">
+        <Scopes>internal_login</Scopes>
+        <Operations mandatory="true">
+            <Operation name="viewConsent">
+                <scope>internal_org_consent_mgt_consent_view</scope>
+            </Operation>
+        </Operations>
+    </Resource>
     <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
     <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
     <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>
@@ -410,9 +431,30 @@
         <Scopes>internal_consent_mgt_purpose_update</Scopes>
     </Resource>
 
-    <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST"/>
-    <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET"/>
-    <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET"/>
+    <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST">
+        <Scopes>internal_login</Scopes>
+        <Operations mandatory="true">
+            <Operation name="createConsent">
+                <scope>internal_consent_mgt_consent_create</scope>
+            </Operation>
+        </Operations>
+    </Resource>
+    <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET">
+        <Scopes>internal_login</Scopes>
+        <Operations mandatory="true">
+            <Operation name="viewConsent">
+                <scope>internal_consent_mgt_consent_view</scope>
+            </Operation>
+        </Operations>
+    </Resource>
+    <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET">
+        <Scopes>internal_login</Scopes>
+        <Operations mandatory="true">
+            <Operation name="viewConsent">
+                <scope>internal_consent_mgt_consent_view</scope>
+            </Operation>
+        </Operations>
+    </Resource>
     <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
     <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
     <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>
diff --git a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2 b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
index 40b48a588a01..87e25bc231be 100644
--- a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
+++ b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
@@ -476,9 +476,30 @@
             <Scopes>internal_org_consent_mgt_purpose_update</Scopes>
         </Resource>
 
-        <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST"/>
-        <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET"/>
-        <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET"/>
+        <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST">
+            <Scopes>internal_login</Scopes>
+            <Operations mandatory="true">
+                <Operation name="createConsent">
+                    <scope>internal_org_consent_mgt_consent_create</scope>
+                </Operation>
+            </Operations>
+        </Resource>
+        <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET">
+            <Scopes>internal_login</Scopes>
+            <Operations mandatory="true">
+                <Operation name="viewConsent">
+                    <scope>internal_org_consent_mgt_consent_view</scope>
+                </Operation>
+            </Operations>
+        </Resource>
+        <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET">
+            <Scopes>internal_login</Scopes>
+            <Operations mandatory="true">
+                <Operation name="viewConsent">
+                    <scope>internal_org_consent_mgt_consent_view</scope>
+                </Operation>
+            </Operations>
+        </Resource>
         <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
         <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
         <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>
@@ -526,9 +547,30 @@
             <Scopes>internal_consent_mgt_purpose_update</Scopes>
         </Resource>
 
-        <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST"/>
-        <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET"/>
-        <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET"/>
+        <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="POST">
+            <Scopes>internal_login</Scopes>
+            <Operations mandatory="true">
+                <Operation name="createConsent">
+                    <scope>internal_consent_mgt_consent_create</scope>
+                </Operation>
+            </Operations>
+        </Resource>
+        <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents" secured="true" http-method="GET">
+            <Scopes>internal_login</Scopes>
+            <Operations mandatory="true">
+                <Operation name="viewConsent">
+                    <scope>internal_consent_mgt_consent_view</scope>
+                </Operation>
+            </Operations>
+        </Resource>
+        <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="GET">
+            <Scopes>internal_login</Scopes>
+            <Operations mandatory="true">
+                <Operation name="viewConsent">
+                    <scope>internal_consent_mgt_consent_view</scope>
+                </Operation>
+            </Operations>
+        </Resource>
         <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
         <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
         <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>

From 85df3705d51a0cb92f17743c9cda9c7232c393ba Mon Sep 17 00:00:00 2001
From: hwupathum <46132469+hwupathum@users.noreply.github.com>
Date: Tue, 23 Jun 2026 11:39:02 +0530
Subject: [PATCH 2/2] API resources for update method

---
 .../resources/system-api-resource.xml                       | 4 ++++
 .../resources/system-api-resource.xml.j2                    | 4 ++++
 .../resources/resource-access-control-v2.xml                | 6 ++++++
 .../resources/resource-access-control-v2.xml.j2             | 6 ++++++
 4 files changed, 20 insertions(+)

diff --git a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml
index f23b1438beb9..b900fb2e0a5b 100644
--- a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml
+++ b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml
@@ -1020,6 +1020,8 @@
                    description="View Consents"/>
             <Scope displayName="Create Consent" name="internal_consent_mgt_consent_create"
                    description="Create new Consent"/>
+            <Scope displayName="Update Consent" name="internal_consent_mgt_consent_update"
+                   description="Update Consent"/>
         </Scopes>
     </APIResource>
     <APIResource name="Consent Management V2 Elements API" identifier="/o/api/identity/consent-mgt/v2.0/elements"
@@ -1056,6 +1058,8 @@
                    description="View Consents in the organization"/>
             <Scope displayName="Create Consent" name="internal_org_consent_mgt_consent_create"
                    description="Create new Consent in the organization"/>
+            <Scope displayName="Update Consent" name="internal_org_consent_mgt_consent_update"
+                   description="Update Consent in the organization"/>
         </Scopes>
     </APIResource>
     <APIResource name="Consent Purpose Application Mapping API"
diff --git a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2 b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
index a7b2bfea2ece..fc8a31adedc3 100644
--- a/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
+++ b/features/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt.server.feature/resources/system-api-resource.xml.j2
@@ -1016,6 +1016,8 @@
                    description="View Consents"/>
             <Scope displayName="Create Consent" name="internal_consent_mgt_consent_create"
                    description="Create new Consent"/>
+            <Scope displayName="Update Consent" name="internal_consent_mgt_consent_update"
+                   description="Update Consent"/>
         </Scopes>
     </APIResource>
     <APIResource name="Consent Management V2 Elements API" identifier="/o/api/identity/consent-mgt/v2.0/elements"
@@ -1052,6 +1054,8 @@
                    description="View Consents in the organization"/>
             <Scope displayName="Create Consent" name="internal_org_consent_mgt_consent_create"
                    description="Create new Consent in the organization"/>
+            <Scope displayName="Update Consent" name="internal_org_consent_mgt_consent_update"
+                   description="Update Consent in the organization"/>
         </Scopes>
     </APIResource>
     <APIResource name="Consent Purpose Application Mapping API"
diff --git a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
index 572249e33cea..fe5dc0e0e052 100644
--- a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
+++ b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml
@@ -384,6 +384,9 @@
             </Operation>
         </Operations>
     </Resource>
+    <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="PATCH">
+        <Scopes>internal_org_consent_mgt_consent_update</Scopes>
+    </Resource>
     <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
     <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
     <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>
@@ -455,6 +458,9 @@
             </Operation>
         </Operations>
     </Resource>
+    <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="PATCH">
+        <Scopes>internal_consent_mgt_consent_update</Scopes>
+    </Resource>
     <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
     <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
     <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>
diff --git a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2 b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
index 87e25bc231be..3bedc5128b2b 100644
--- a/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
+++ b/features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/resource-access-control-v2.xml.j2
@@ -500,6 +500,9 @@
                 </Operation>
             </Operations>
         </Resource>
+        <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="PATCH">
+            <Scopes>internal_org_consent_mgt_consent_update</Scopes>
+        </Resource>
         <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
         <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
         <Resource context="(.*)/o/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>
@@ -571,6 +574,9 @@
                 </Operation>
             </Operations>
         </Resource>
+        <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)$" secured="true" http-method="PATCH">
+            <Scopes>internal_consent_mgt_consent_update</Scopes>
+        </Resource>
         <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/revoke" secured="true" http-method="POST"/>
         <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/authorize" secured="true" http-method="POST"/>
         <Resource context="(.*)/api/identity/consent-mgt/v2.0/consents/(.+)/validate" secured="true" http-method="GET"/>