---
title: "Protected Resource Metadata"
method: GET
path: "/.well-known/oauth-protected-resource"
tags: ["mcp"]
---

# Protected Resource Metadata

`GET /.well-known/oauth-protected-resource`

## Request

- Base URL: `https://api.alert.camp` (the document declares no server; this is the origin it was published from)
- URL: `https://api.alert.camp/.well-known/oauth-protected-resource`
- Auth: none declared

Tell a client where credentials for this resource come from.

Required of an MCP server by the 2026-07-28 spec.  ``resource`` is the
canonical identifier a token's ``aud`` must equal — publishing it is
what lets a client ask its authorization server for a token scoped to
US rather than one that would work anywhere.

``authorization_servers`` lists this service: AlertCamp issues its own
MCP tokens today (see ``services/mcp_tokens.py``).  When the full
OAuth 2.1 authorization-code + CIMD flow lands (plan §6.3 step 2) the
entry stays the same — only the flow behind it changes.

## Query parameters

- `resource_path` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/alert/apis/alertcamp.md) · [All operations](https://skmtc.dev/alert/apis/alertcamp/llms.txt) · [OpenAPI document](https://skmtc.dev/alert/apis/alertcamp/revisions/864c8c9ef833?raw)