---
title: "Discover the configured Commerce MCP OAuth resource"
method: GET
path: "/.well-known/oauth-protected-resource/v1/commerce/mcp"
---

# Discover the configured Commerce MCP OAuth resource

`GET /.well-known/oauth-protected-resource/v1/commerce/mcp`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/.well-known/oauth-protected-resource/v1/commerce/mcp`
- Auth: none required

Registered only when COMMERCE_MCP_OAUTH_ENABLED=1 and both canonical
HTTPS resource and issuer URLs are configured. Otherwise this route is
absent. The document is static public metadata; no authority, identity,
credential or tenant store is consulted. Request headers cannot change
its resource or authorization server. Responses use Cache-Control:
no-store and Access-Control-Allow-Origin: *.
scopes_supported contains the three reviewer scopes by default. The
additional erp:read and history:assess scopes appear only when the separate
data-access feature is enabled. Advertising support grants no permission;
each request is independently authenticated and consent checked.
The additional marketplace:read, erp:validate, approval:request and
erp:configure scopes appear only with the connected feature enabled.

## Response `200`

RFC 9728 protected resource metadata

- CommerceOAuthResourceMetadata
  - `resource` string, uri, required
  - `authorization_servers` string[], required
  - `scopes_supported` union, required
    - unknown
    - unknown
    - unknown
  - `bearer_methods_supported` unknown, required
  - `resource_name` 'Commerce Gate', required

## Other responses

- `404`: The deployment has not enabled Commerce MCP OAuth

---

[API](https://skmtc.dev/decionis/apis/decionis-commerce-gate-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-commerce-gate-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-commerce-gate-api/revisions/9fecb7109bf8?raw)