> ## Documentation Index > Fetch the complete documentation index at: https://docs.mudraid.ai/llms.txt > Use this file to discover all available pages before exploring further. # OAuth 2.0 Authorization Server Metadata (RFC 8414) > Advertises only what this authorization server implements and has enabled right now; fields for disabled capabilities are omitted rather than listed. `issuer` is the exact `iss` stamped into access tokens. `scopes_supported` is deliberately absent — scopes vary per protected resource. The identity contract still classifies this document as a live preview: its fields are capability-derived and may widen as capabilities are enabled, so read them rather than hardcoding them. Sets `Cache-Control: public, max-age=3600`. Answers `404` when the deployment has disabled the metadata document. ## OpenAPI ````yaml /openapi.yaml get /.well-known/oauth-authorization-server openapi: 3.0.3 info: title: MudraID Public Contracts version: 2.0.0 description: > This document defines the **public contracts** an integrator calls directly: the OAuth endpoints an agent's machine client uses to obtain an access token, the discovery documents a resource server verifies those tokens with, the scope file the FastAPI middleware loads, and the live decision endpoint enforcement adapters call. Administrative and internal endpoints are intentionally omitted — they are documented by each FastAPI service's auto-generated `/openapi.json` at runtime and may evolve more freely. What lives in *this* file: - `POST /oauth2/token` — machine-client `client_credentials` exchange - `POST /oauth2/revoke` — RFC 7009 token revocation - `GET /.well-known/oauth-authorization-server` — RFC 8414 metadata - `GET /.well-known/jwks.json` — token-verification keys - `GET /api/v1/platforms/{platform_id}/scopes.yaml` — scope file for the middleware - `POST /api/v1/adapter/enforcement/decide` — live decision for one protected action - the access-token claim shape and the `mudraid_scopes.yaml` schema **Retired native agent credentials.** `POST /api/v1/auth/token`, `POST /api/v1/auth/verify`, `POST /api/v1/auth/agents/me/platforms`, `POST /api/v1/agents/register`, `PUT /api/v1/agents/{agent_id}/permissions/{platform_id}` and `POST /api/v1/agents/{agent_id}/rotate-secret` (and its `/emergency` variant) answer `410 Gone` with `code: agent_native_credentials_retired`. Register an agent identity (`POST /api/v1/agents/identities`), link an OAuth machine client to it and use `POST /oauth2/token`. Every `/api/v1/verify/*` path also answers `410 Gone` with the same code. servers: - url: https://api.mudraid.ai description: Production security: [] tags: - name: oauth description: | OAuth 2.0 endpoints. A machine client linked to an agent authenticates here with `private_key_jwt` (recommended) or, with an organization compatibility approval, `client_secret_basic`. - name: resource-server description: | Documents a protected API (or the FastAPI middleware) reads to verify access tokens and enforce route scopes. - name: enforcement description: | The live decision endpoint called by enforcement adapters (the V2 middleware, the Node adapter/sidecar and the Kong plugin). paths: /.well-known/oauth-authorization-server: get: tags: - oauth summary: OAuth 2.0 Authorization Server Metadata (RFC 8414) description: | Advertises only what this authorization server implements and has enabled right now; fields for disabled capabilities are omitted rather than listed. `issuer` is the exact `iss` stamped into access tokens. `scopes_supported` is deliberately absent — scopes vary per protected resource. The identity contract still classifies this document as a live preview: its fields are capability-derived and may widen as capabilities are enabled, so read them rather than hardcoding them. Sets `Cache-Control: public, max-age=3600`. Answers `404` when the deployment has disabled the metadata document. responses: '200': description: Authorization-server metadata content: application/json: schema: type: object required: - issuer - token_endpoint - jwks_uri - grant_types_supported - token_endpoint_auth_methods_supported properties: issuer: type: string format: uri token_endpoint: type: string format: uri jwks_uri: type: string format: uri grant_types_supported: type: array items: type: string example: - client_credentials token_endpoint_auth_methods_supported: type: array items: type: string example: - private_key_jwt - client_secret_basic token_endpoint_auth_signing_alg_values_supported: type: array items: type: string example: - RS256 - ES256 revocation_endpoint: type: string format: uri description: Present only when the refresh-token capability is enabled. revocation_endpoint_auth_methods_supported: type: array items: type: string authorization_endpoint: type: string format: uri description: Present only when the human-delegation flow is enabled. response_types_supported: type: array items: type: string code_challenge_methods_supported: type: array items: type: string authorization_response_iss_parameter_supported: type: boolean service_documentation: type: string format: uri x-mudraid-access-token-signing-alg-values-supported: type: array items: type: string example: - RS256 x-mudraid-supported-token-profiles: type: array items: type: string example: - mudraid-access-token-v2 '404': description: Metadata disabled for this deployment. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.