check scope for users api calls