List available OAuth scopes

Rate limit: 60 requests per 60 seconds. This is the default shared quota — it is shared with every other endpoint that has no dedicated limit, so requests across those endpoints all draw from the same budget.

Returns the public catalog of OAuth scopes that can be requested when creating or updating an application. Scopes are served from an in-memory cache that is refreshed periodically from the upstream sts-metadata-api. Use this endpoint to render scope pickers and to validate scope ids client-side before calling create/update.