The biggest thing you have left out is one API calling another API which requires on-behalf-of flow. This is an extremely common scenario and yet mostly glossed over until the day you have to do it in a real enterprise to flow the delegated identity.