What is minimal OAuth scope to know user's ZUID and ZOID?

What is minimal OAuth scope to know user's ZUID and ZOID?

Hi! I need to link Zoho's user's account and organization with user and organization in my App.
I know scope "aaaserver.profile.READ" shows ZUID at "/oauth/user/info" endpoint.
And "openid" scope shows string 123.456 in "sub" key of "identy_token" JWT payload of "request access token" response, where 123 is ZUID and 456 is not ZOID (not documented).

Also, what is minimal scope to know if user is of an admin role? To grant him/her permission to link organizations between Zoho and my app.

Currently, I had to request "ZohoCRM.org.READ" (for organization id ZOID), "ZohoCRM.settings.roles.READ" (to know whether user is of an admin role) and "ZohoCRM.users.READ" (to get role), which seems like too much permissions for just login to my app.

Thank you!