Uma_protection is an OAuth Scope
defined by User Managed Access
An Entity seeking Protection API Access MUST have the OAuth Scope Uma_protection
An Access Token with Uma_protection OAuth Scope is called a Protection API Token (PAT).
An Entity that can acquire an Access Token with Uma_protection OAuth Scope is by definition a Resource Server.
There might be more information for this subject on one of the following: