A county library API uses an OCI Functions authorizer in front of HTTP back ends. After authentication succeeds, routes must enforce which operations the patron may perform, and one back-end URL needs a library-branch id injected from the authorizer. What should the authorizer return?
Select an answer to reveal the explanation.
Short Explanation
The authorizer is like a bouncer who stamps your wristband with what you may do and a table number—not the chef who cooks the meal. It returns whether the client is authenticated, the access scopes for allowed operations, and optional context the gateway can plug into back-end URLs. The route’s authorization policy then applies those scopes; the authorizer is not the business API.
Full Explanation
The OCI API Gateway authorizer contract lets the function decide authentication, return access scopes describing permitted operations, and optionally return key-value context variables (for example values used in an HTTP back-end URL). The gateway applies the route’s authorization policy against those scopes. The authorizer authenticates and shapes authorization inputs; it is not the back-end business function that fulfills the API.