Skip to content
GitmoapAPIBeta
Identity & platformoauth
GET/.well-known/oauth-protected-resource/mcp

Which authorization server protects the MCP service, and what it can grant

oauth_protected_resource_metadata
  • Public
    This operation declares no security requirement: it takes no token.

The protected resource metadata document (RFC 9728) for this deployment's MCP service: its address, the authorization server that issues access to it, that access tokens travel in the Authorization header, and the scopes it understands. Anyone may read it, without signing in.

Responses

200Protected resource metadata for the MCP serviceapplication/json
  • authorization_serversarray of string
  • bearer_methods_supportedarray of string
  • resourcestring
  • resource_namestring
  • scopes_supportedarray of string
  • resource_documentationstring or nulloptional
200 exampleSynthesized example
{
"authorization_servers": [
"authorization-servers-8e00"
],
"bearer_methods_supported": [
"bearer-methods-supported-e999"
],
"resource": "resource-5ac4",
"resource_name": "payments-api",
"scopes_supported": [
"scopes-supported-563f"
],
"resource_documentation": "resource-documentation-5911"
}
501The authorization server is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-85ef",
"message": "Stream pipeline status into the run header"
}
}

CLI

gitmoap oauth oauth-protected-resource-metadata