---
title: "Protected resource metadata (RFC 9728)"
method: GET
path: "/.well-known/oauth-protected-resource/v1/agent/mcp"
tags: ["OAuth"]
---

# Protected resource metadata (RFC 9728)

`GET /.well-known/oauth-protected-resource/v1/agent/mcp`

## Request

- Base URL: `https://api.educaplay.com`
- URL: `https://api.educaplay.com/.well-known/oauth-protected-resource/v1/agent/mcp`
- Auth: none required

Discovery document of the MCP server as an OAuth 2.1 protected resource. MCP clients fetch it from the URL announced in the `WWW-Authenticate` header of a `401` answer of the MCP endpoint, or directly at this path. It names the authorization server (this same API) and the supported scopes.

## Response `200`

Metadata document.

- ProtectedResourceMetadata
  - `resource` string, uri: Canonical URL of the MCP endpoint.
  - `authorization_servers` string[]
  - `bearer_methods_supported` string[]
  - `scopes_supported` string[]

## Changes

- **2026-10-19** `e31d97013d0d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/educaplay/apis/educaplay-api/changes/.well-known/oauth-protected-resource/v1/agent/mcp/get.md)

---

[API](https://skmtc.dev/educaplay/apis/educaplay-api.md) · [All operations](https://skmtc.dev/educaplay/apis/educaplay-api/llms.txt) · [OpenAPI document](https://skmtc.dev/educaplay/apis/educaplay-api/revisions/e31d97013d0d?raw)