ScoutID Data Reference

ScoutID Data Reference

ScoutID exposes user data as claims in OIDC tokens, sourced from Scoutnet — the national membership management system of Scouterna. The data comes from user-level Scoutnet APIs, meaning each token contains only information about the user who is currently signing in.

Scopes and claims

ScoutID extends the standard OIDC scopes profile, email, and phone with scout-specific claims, and provides a dedicated scoutnet-memberships scope for organisational data.

openid (always included)

Claim	Type	Description
sub	string	Keycloak-generated UUID identifying the user. We expect this to be immutable, but we cannot guarantee it over time. The member number is the stable identifier. See Advanced Topics if you need a predictable value.
preferred_username	string	Always in the format <member_no>@scoutnet, e.g. 9876543@scoutnet.

Note that preferred_username was scoutnet\|9876543 in versions of the provider prior to v0.14.0.

profile

Claim	Type	Description
name	string	Full name.
given_name	string	First name.
family_name	string	Last name.
picture	string	URL to the user's Scoutnet avatar.
birthdate	string	Date of birth in YYYY-MM-DD format.
locale	string	User's locale, e.g. sv.
scoutnet_member_no	string	The user's Scoutnet member number.

email

Claim	Type	Description
email	string	The user's primary email. May be either a group-specific address or a personal Scoutnet email depending on the user's setup. Do not rely on it being a specific type — use the more specific claims below if you need a particular address.
email_verified	boolean	Always true for ScoutID users.
scouterna_email	string	A @scouterna.se address. Only present for users with a national-level position.
alt_email	string	An additional email address. Only present for users who have one populated in Scoutnet.

phone

Claim	Type	Description
phone_number	string	Phone number in E.164 format, e.g. +46701234567.

scoutnet-memberships

Claim	Type	Description
primary_group_name	string	Name of the user's primary scout group.
primary_group_no	string	ID of the user's primary scout group. Matches a key in memberships.groups.
group_emails_json	object	Map of group ID → group-specific email address for this user.
memberships	object	Full organisational membership data. See below.

To request this scope, add scoutnet-memberships to your client's requested scopes.

---

The memberships claim

memberships is a JSON object describing everything Scoutnet knows about this user's roles and organisational relationships. It is keyed by entity type.

{
  "groups": { ... },
  "troops": { ... },
  "patrols": { ... },
  "organisations": { ... },
  "regions": { ... },
  "districts": { ... },
  "corps": { ... },
  "networks": { ... },
  "projects": { ... }
}

Each entity type maps entity IDs (strings) to an entry object. Entity types that the user has no memberships in are present as empty objects {}.

Entry structure by entity type

Entity type	Fields
groups	name, is_primary, roles[]
troops	name (optional), groupId (int or null), roles[]
patrols	name (optional), groupId (int or null), roles[]
organisations, regions, districts, corps, networks, projects	roles[] only

Each role object contains:

Field	Type	Notes
id	integer	Numeric role ID in Scoutnet.
key	string	Machine-readable role key, e.g. it_manager, leader. Always present.
name	string	Human-readable display name. Only populated for group-level roles where a translation is available. Absent for troops, patrols, and higher-level entities.

Things to watch out for

Troops and patrols may lack a name. The Scoutnet API does not always provide names for troops and patrols. The primary troop of a group will have a name, but others may not. Always handle the case where name is absent.

Troops and patrols may lack a groupId. The groupId field links a troop or patrol back to its parent group, but it can be null when this information is unavailable in Scoutnet. Do not assume it is always set.

Higher-level entities have no name. Organisations, regions, districts, corps, networks, and projects currently carry only roles[] — there is no entity name exposed at those levels. This is a limitation of the current Scoutnet APIs and may change in the future.

Role name is absent outside of groups. If your application needs to display a role's label for non-group entities, use key and provide your own translations.

email is not guaranteed to be a specific type. See the email scope section above.

Example

The following is an abbreviated example of a memberships object for a user who is a leader in a group and a vice-leader in a troop:

"memberships": {
  "groups": {
    "999": {
      "name": "Scoutkåren Mälarscouterna",
      "is_primary": true,
      "roles": [
        {"id": 136, "key": "it_manager", "name": "IT Manager"}
      ]
    }
  },
  "troops": {
    "12345": {
      "name": "Yggdrasil",
      "groupId": 999,
      "roles": [{"id": 4, "key": "vice_leader"}]
    },
    "12346": {
      "groupId": null,
      "roles": [{"id": 11, "key": "leader"}]
    }
  },
  "organisations": {
    "111": {
      "roles": [{"id": 68, "key": "board_member"}]
    }
  },
  "patrols": {},
  "regions": {},
  "districts": {},
  "corps": {},
  "networks": {},
  "projects": {}
}

Note that troop 12346 has no name and groupId is null — both are valid states your application must handle.

For a full token example, see access_token_example.json and id_token_example.json in the provider repository.