fullstop/src/main/java/org/zalando/stups/fullstop/config/OAuth2Configuration.java
@Override
    public void configure(final HttpSecurity http) throws Exception {

        http.sessionManagement().sessionCreationPolicy(NEVER)

            // configure form login
            .and().formLogin().disable()

            // configure logout
                .logout().disable()

                .authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS).permitAll() // Allow preflight CORS requests from browsers
                .antMatchers("/").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/api/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/s3/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/swagger-resources").permitAll()
                .antMatchers("/api-docs").permitAll();

    }
@Override
    public void configure(final HttpSecurity http) throws Exception {

        http.sessionManagement().sessionCreationPolicy(NEVER)

            // configure form login
            .and().formLogin().disable()

            // configure logout
                .logout().disable()

                .authorizeRequests()
                .antMatchers(HttpMethod.OPTIONS).permitAll() // Allow preflight CORS requests from browsers
                .antMatchers("/").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/api/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/s3/**").access("#oauth2.hasUidScopeAndAnyRealm('/employees', '/services')")
                .antMatchers("/webjars/**").permitAll()
                .antMatchers("/swagger-resources").permitAll()
                .antMatchers("/api-docs").permitAll();

    }
Configure scopes for specific controller/httpmethods/roles here.