check scope for institutions api calls