Want to understand OAuth Code flow where Application passes the Access_Token on user's behalf to the API to get the resources

Question

I like to know my understanding is correct and also like to clarify my doubts further.

1) Confirm my Understanding:

In the below image, I have