With no scope enforced on the developer key, the following request returns the Course object along with the total_students and term information:
/api/v1/courses?include[]=term&include[]=total_students
After enforcing the scope and permitting only url:GET|/api/v1/courses , the Course object returns but does not include the terms or total_student fields.
I cannot find anything in the documentation (https://canvas.instructure.com/doc/api/courses.html#method.courses.index) that would indicate these two fields require additional scope. Does anyone know if that is the case and if so, what scope is required to get these two additional attributes?
There is a setting on the developer key for "Allow Include Parameters". When that option is disabled Canvas will ignore include and includes parameters.
You can read more about it here: https://canvas.instructure.com/doc/api/file.developer_keys.html under "Canvas API Includes"