In OpenId Connect Implict flow, after the authorization server has authenticated the user and the user has granted the client access to the requested claims, an Id token is given back to the client.
This Id token contains Claims about the authentication of an End-User by an Authorization Server. These claims consists of a set of required claims, some optional and "MAY contain other Claims".
At a later point, the client may hand the access token to an API, which in turn can retrieve information claims from the UserInfo endpoint.
What is the reason that the claims returned by the UserInfo endpoint is not returned directly to the client after the user has been authorized instead, as part of the Id Token? Why is the UserInfo endpoint necessary? If the claims were returned as part of the Id token, no additional claims would be needed.
Is it because the Id Token may contain data which one don't want to share with the API, such as a refresh token?