# Get OAuth protected resource metadata.

The canonical /mcp resource advertises the complete scope catalog, matching the general protected-resource and authorization-server metadata.

Canonical: https://commentary.dev/docs/reference/api/get-oauth-protected-resource-metadata

`GET /.well-known/oauth-protected-resource`

The canonical /mcp resource advertises the complete scope catalog, matching the general protected-resource and authorization-server metadata.

## Access

This operation does not declare a credential requirement in the released API contract.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. [Set up developer access](/docs/build/developer-access).

## Parameters

| Name | Location | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `resource` | query | string | No |  |

## Call the endpoint

Replace path placeholders and your credential. For body operations, create `request.json` using the required fields above; this command does not invent resource identifiers or consent.

```bash
curl --request GET \
  'https://commentary.dev/.well-known/oauth-protected-resource'
```

## Responses

| Status | Meaning | Payload |
| --- | --- | --- |
| `200` | Successful response. | object |

### Successful response fields

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `resource` | string | No | Format: uri. |
| `authorization_servers` | array of string | No |  |
| `resource_documentation` | string | No | Format: uri. |
| `scopes_supported` | array of [ExternalScope](/docs/reference/schemas/external-scope) | No |  |
| `commentary_resources` | array of string | No |  |
| `commentary_openapi` | string | No | Format: uri. |

## Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

## Contract and related guidance

Operation ID: `getOAuthProtectedResourceMetadata`. [Download the OpenAPI contract](/docs/reference/openapi.json) for complete constraints and code generation. [Browse endpoints](/docs/reference/api-operations).