OpenID Connect and IdentityServer4: APIs vs scopes - asp.net-core

Question

http://docs.identityserver.io/en/latest/reference/api_resource.html says "An API must have at least one scope."
It seems this restriction is not enforced by IdentityServer4: I have
public static IEnumerable<ApiResource> GetApis(IConfiguration config)
{
return new ApiResource[]
{
new ApiResource("orm", "Our ORM"),
};
}
(without scopes here) and my software does work and seems not to produce any errors. Do I understand correctly that here I have an error but IdentityServer4 just does not diagnose the error?
Moreover, I have
new Client
{
ClientId = "mvc",
ClientName = "MVC Client",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
ClientSecrets = { new Secret("XXX".Sha256()) },
RedirectUris = { ormClientURL + "/signin-oidc" },
FrontChannelLogoutUri = ormClientURL + "/signout-oidc",
PostLogoutRedirectUris = { ormClientURL + "/signout-callback-oidc" },
AllowOfflineAccess = true,
AllowedScopes = { "openid", "profile", "orm" }
},
and it works despite I have no scope "orm" defined.
Why does it indeed work?
How to fix this properly? (Which clients and scopes should I define?)

Answer 1

It appears that the ApiResource constructor adds a Scope using the name and displayName provided:
public ApiResource(string name, string displayName)
: this(name, displayName, null)
{
}
public ApiResource(string name, string displayName, IEnumerable<string> claimTypes)
{
if (name.IsMissing()) throw new ArgumentNullException(nameof(name));
Name = name;
DisplayName = displayName;
Scopes.Add(new Scope(name, displayName));
if (!claimTypes.IsNullOrEmpty())
{
foreach (var type in claimTypes)
{
UserClaims.Add(type);
}
}
}
https://github.com/IdentityServer/IdentityServer4/blob/master/src/Storage/src/Models/ApiResource.cs