---
title: "Oauth Protected Resource Pathed"
method: GET
path: "/.well-known/oauth-protected-resource/{resource_path}"
---

# Oauth Protected Resource Pathed

`GET /.well-known/oauth-protected-resource/{resource_path}`

## Request

- Base URL: `https://mcp.sentinelx.app` (the document declares no server; this is the origin it was published from)
- URL: `https://mcp.sentinelx.app/.well-known/oauth-protected-resource/{resource_path}`
- Auth: none declared

RFC 9728 path-suffixed variant.

Some MCP clients (e.g. VS Code) derive the metadata URL from the resource
path — /.well-known/oauth-protected-resource/<path> — instead of using the
WWW-Authenticate `resource_metadata` value, and validate that the returned
`resource` matches the exact URL they connected to (e.g. .../mcp/mcp).
Serving this variant lets those clients complete discovery and delegate to
the authorization server (Keycloak), where DCR is same-origin and works.

## Path parameters

- `resource_path` string, required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/sentinelx/apis/sentinelx-hub.md) · [All operations](https://skmtc.dev/sentinelx/apis/sentinelx-hub/llms.txt) · [OpenAPI document](https://skmtc.dev/sentinelx/apis/sentinelx-hub/revisions/d1f84924795e?raw)