Discovery Metadata

Two discovery documents let a client configure itself without hardcoding endpoint URLs. Both are public, unauthenticated GET requests that return static JSON. Most integrations can skip these and use the documented endpoints directly. They exist for OAuth client libraries that bootstrap from metadata.

Endpoints

GET /.well-known/oauth-authorization-server
GET /.well-known/oauth-protected-resource

Authentication

None. Both documents are public.

Authorization Server Metadata

Describes the authorization server, per RFC 8414.

curl https://platform.chamelio.ai/.well-known/oauth-authorization-server

import requests

response = requests.get(
    "https://platform.chamelio.ai/.well-known/oauth-authorization-server"
)
print(response.json())

const response = await fetch(
  'https://platform.chamelio.ai/.well-known/oauth-authorization-server'
);

const metadata = await response.json();
console.log(metadata);

Success Response

Status Code: 200 OK

{
  "issuer": "https://platform.chamelio.ai",
  "authorization_endpoint": "https://platform.chamelio.ai/oauth/authorize",
  "token_endpoint": "https://platform.chamelio.ai/oauth/token",
  "revocation_endpoint": "https://platform.chamelio.ai/oauth/revoke",
  "response_types_supported": ["code"],
  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "refresh_token"
  ],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["client_secret_post", "none"],
  "scopes_supported": ["workflows:read", "workflows:write", "tasks:read", "tasks:write", "files:read", "users:read", "users:write", "sor:read", "sor:write", "clickwrap:read", "clickwrap:write", "..."]
}

scopes_supported is abbreviated above. It returns the complete scope registry, which can include values reserved for endpoints that do not exist yet. The scopes enforced by live endpoints are listed on OAuth Apps.

Response Fields

Field	Type	Description
`issuer`	string	The authorization server’s identifier
`authorization_endpoint`	string	Where to send users to consent
`token_endpoint`	string	Where to exchange codes and refresh tokens
`revocation_endpoint`	string	Where to revoke a token
`response_types_supported`	array	Always `["code"]`
`grant_types_supported`	array	The three supported grants
`code_challenge_methods_supported`	array	Always `["S256"]` - PKCE is mandatory and `plain` is rejected
`token_endpoint_auth_methods_supported`	array	`client_secret_post` for confidential clients, `none` for public clients. HTTP Basic is absent by design
`scopes_supported`	array	Every scope in the registry

Protected Resource Metadata

Describes the API as an OAuth protected resource, per RFC 9728.

curl https://platform.chamelio.ai/.well-known/oauth-protected-resource

import requests

response = requests.get(
    "https://platform.chamelio.ai/.well-known/oauth-protected-resource"
)
print(response.json())

const response = await fetch(
  'https://platform.chamelio.ai/.well-known/oauth-protected-resource'
);

const metadata = await response.json();
console.log(metadata);

Success Response

Status Code: 200 OK

{
  "resource": "https://platform.chamelio.ai",
  "authorization_servers": ["https://platform.chamelio.ai"],
  "scopes_supported": ["workflows:read", "workflows:write", "tasks:read", "tasks:write", "files:read", "users:read", "users:write", "sor:read", "sor:write", "clickwrap:read", "clickwrap:write", "..."],
  "bearer_methods_supported": ["header"]
}

scopes_supported is abbreviated above, exactly as in the authorization server document.

Response Fields

Field	Type	Description
`resource`	string	The protected resource’s identifier
`authorization_servers`	array	Authorization servers that can issue tokens for this resource
`scopes_supported`	array	Every scope in the registry
`bearer_methods_supported`	array	Always `["header"]` - tokens must be sent in the `Authorization` header, not as a query parameter or form field

Notes

Chamelio is both the authorization server and the protected resource, so issuer, resource, and authorization_servers all point at the same origin.

Use Cases

OAuth client libraries - Let a library configure its endpoints from metadata
Environment portability - Resolve endpoints per environment instead of hardcoding them
Capability checks - Confirm the supported grants and PKCE methods before implementing a flow

Overview

API Key Access

OAuth App Access

Webhooks

Endpoints

Authentication

Authorization Server Metadata

Success Response

Response Fields

Protected Resource Metadata

Success Response

Response Fields

Notes

Use Cases

​Endpoints

​Authentication

​Authorization Server Metadata

​Success Response

​Response Fields

​Protected Resource Metadata

​Success Response

​Response Fields

​Notes

​Use Cases

Endpoints

Authentication

Authorization Server Metadata

Success Response

Response Fields

Protected Resource Metadata

Success Response

Response Fields

Notes

Use Cases