Get oauth server metadata

GET/.well-known/oauth-authorization-server

Authorization server metadata (RFC 8414) for MCP clients

An MCP client reads it after the AI plane's Protected Resource Metadata names this issuer.Show more

An MCP client reads it after the AI plane's Protected Resource Metadata names this issuer. Not envelope-shaped (see the identity tag). Where grants are off the route answers 404 NOT_FOUND.

Request body

This operation takes no request body.

Responses

200The metadata documentOAuthServerMetadata
404NOT_FOUND — unknown or expired ref (unguessable refs, 15)ApiErrorResponse
500INTERNAL — a bug, and traceId is the support handle.ApiErrorResponse

Errors you should handle

Branch on code and honour retryable — never on the HTTP status alone.

404	NOT_FOUND searchRef SR-F-7b31d0a9 is unknown or has expired; re-search	not retryable
500	INTERNAL An unexpected error occurred. Quote the traceId to support.	retryable

{ "issuer": "https://apiq-sandbox.tripproagencysites.com", "authorization_endpoint": "https://apiq-sandbox.tripproagencysites.com/v1/oauth/authorize", "token_endpoint": "https://apiq-sandbox.tripproagencysites.com/v1/oauth/token", "registration_endpoint": "https://apiq-sandbox.tripproagencysites.com/v1/oauth/register", "device_authorization_endpoint": "https://apiq-sandbox.tripproagencysites.com/v1/oauth/device_authorization", "revocation_endpoint": "https://apiq-sandbox.tripproagencysites.com/v1/oauth/revoke", "scopes_supported": [ "mcp:console:read", "mcp:console:write", "mcp:supplier:read" ], "response_types_supported": [ "code" ], "response_modes_supported": [ "query" ], "grant_types_supported": [ "authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code" ], "token_endpoint_auth_methods_supported": [ "none" ], "revocation_endpoint_auth_methods_supported": [ "none" ], "code_challenge_methods_supported": [ "S256" ], "client_id_metadata_document_supported": true, "authorization_response_iss_parameter_supported": true }