Looking at the RequestPermissions API, it says that the scope is supposed to be a string. However, I have been unsuccessful in finding out how to specify more than one scope (specifically EXPRESS_CHECKOUT and REFUND). Comma-separated, semi-colon, and even using their NVP list syntax didn't work. A CURL sample would be greatly appreciated.
Comma-separated example...
curl -s --insecure -H
"X-PAYPAL-SECURITY-USERID: API_USERNAME"
-H "X-PAYPAL-SECURITY-PASSWORD: API_PASSWORD"
-H "X-PAYPAL-SECURITY-SIGNATURE: API_SIGNATURE"
-H "X-PAYPAL-REQUEST-DATA-FORMAT: NV"
-H "X-PAYPAL-RESPONSE-DATA-FORMAT: NV"
-H "X-PAYPAL-APPLICATION-ID: APP-80W284485P519543T"
https://svcs.sandbox.paypal.com/Permissions/RequestPermissions -d
"requestEnvelope.errorLanguage=en_US&scope=EXPRESS_CHECKOUT,REFUND&callback=http://my/callback"
When I make that request, I get back "Invalid request parameter scope with value EXPRESS_CHECKOUT,REFUND"