@startuml

title "OAuth2 Authorize Scope Request"

actor User
entity "Service 1" as MS1
entity "Service 2" as MS2
database SSO

User -> MS1 : Login
MS1 -> SSO : Login Redirect
SSO -> User : HTML Form / JSON
User -> SSO : Credentials
SSO -> User : Single-use code
User -> MS1 : Single-use code
MS1 -> SSO : Single-use code, App ID, App Secret
SSO -> MS1 : Access token (with Scopes)
MS1 -> User : Session
User -> MS1 : Analyze external data
MS1 -> MS2 : (Access token) Data endpoint
MS2 -> MS1 : Scoped Data
MS1 -> User : Analysis

@enduml