code: public URI getAuthorizationUri(String clientId, java.util.List<String> scopes, String redirectUri, String responseType, String state) throws IllegalArgumentException, UriBuilderException {
      String formattedScopes = (scopes == null || scopes.size() < 1) ? "" : scopes.get(0);
      StringBuilder sb = new StringBuilder(formattedScopes);
      for (int i = 1; i < scopes.size(); i++) {
        sb.append("%20" + scopes.get(i));
      }
  
      UriBuilder builder = UriBuilder.fromUri(getOAuthBasePath())
              .scheme("https")
              .path("/oauth/auth")
              .queryParam("response_type", responseType)
              .queryParam("scope", sb.toString())
              .queryParam("client_id", clientId)
              .queryParam("redirect_uri", redirectUri);
      if (state != null) {
        builder = builder.queryParam("state", state);
      }
      return builder.build();
    }
docs: Helper method to configure the OAuth accessCode/implicit flow parameters
  @param clientId OAuth2 client ID: Identifies the client making the request.
  Client applications may be scoped to a limited set of system access.
  @param scopes the list of requested scopes. Values include {@link OAuth#Scope_SIGNATURE}, {@link OAuth#Scope_EXTENDED}, {@link OAuth#Scope_IMPERSONATION}. You can also pass any advanced scope.
  @param redirectUri this determines where to deliver the response containing the authorization code or access token.
  @param responseType determines the response type of the authorization request.
  <br><i>Note</i>: these response types are mutually exclusive for a client application.
  A public/native client application may only request a response type of "token";
  a private/trusted client application may only request a response type of "code".
  @param state Allows for arbitrary state that may be useful to your application.
  The value in this parameter will be round-tripped along with the response so you can make sure it didn't change.