> ## Documentation Index
> Fetch the complete documentation index at: https://docs.chamelio.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Discovery Metadata

> Machine-readable authorization server and protected resource metadata

Two discovery documents let a client configure itself without hardcoding endpoint URLs. Both are
public, unauthenticated `GET` requests that return static JSON.

Most integrations can skip these and use the documented endpoints directly. They exist for OAuth
client libraries that bootstrap from metadata.

## Endpoints

```
GET /.well-known/oauth-authorization-server
GET /.well-known/oauth-protected-resource
```

## Authentication

None. Both documents are public.

## Authorization Server Metadata

Describes the authorization server, per RFC 8414.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://platform.chamelio.ai/.well-known/oauth-authorization-server
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://platform.chamelio.ai/.well-known/oauth-authorization-server"
  )
  print(response.json())
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    'https://platform.chamelio.ai/.well-known/oauth-authorization-server'
  );

  const metadata = await response.json();
  console.log(metadata);
  ```
</CodeGroup>

### Success Response

**Status Code:** `200 OK`

```json theme={null}
{
  "issuer": "https://platform.chamelio.ai",
  "authorization_endpoint": "https://platform.chamelio.ai/oauth/authorize",
  "token_endpoint": "https://platform.chamelio.ai/oauth/token",
  "revocation_endpoint": "https://platform.chamelio.ai/oauth/revoke",
  "response_types_supported": ["code"],
  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "refresh_token"
  ],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["client_secret_post", "none"],
  "scopes_supported": ["workflows:read", "workflows:write", "tasks:read", "tasks:write", "files:read", "users:read", "users:write", "sor:read", "sor:write", "clickwrap:read", "clickwrap:write", "..."]
}
```

<Info>
  `scopes_supported` is abbreviated above. It returns the complete scope registry, which can include
  values reserved for endpoints that do not exist yet. The scopes enforced by live endpoints are
  listed on [OAuth Apps](/api-reference/oauth-apps#scopes).
</Info>

### Response Fields

| Field                                   | Type   | Description                                                                                              |
| --------------------------------------- | ------ | -------------------------------------------------------------------------------------------------------- |
| `issuer`                                | string | The authorization server's identifier                                                                    |
| `authorization_endpoint`                | string | Where to send users to consent                                                                           |
| `token_endpoint`                        | string | Where to exchange codes and refresh tokens                                                               |
| `revocation_endpoint`                   | string | Where to revoke a token                                                                                  |
| `response_types_supported`              | array  | Always `["code"]`                                                                                        |
| `grant_types_supported`                 | array  | The three supported grants                                                                               |
| `code_challenge_methods_supported`      | array  | Always `["S256"]` - PKCE is mandatory and `plain` is rejected                                            |
| `token_endpoint_auth_methods_supported` | array  | `client_secret_post` for confidential clients, `none` for public clients. HTTP Basic is absent by design |
| `scopes_supported`                      | array  | Every scope in the registry                                                                              |

## Protected Resource Metadata

Describes the API as an OAuth protected resource, per RFC 9728.

<CodeGroup>
  ```bash cURL theme={null}
  curl https://platform.chamelio.ai/.well-known/oauth-protected-resource
  ```

  ```python Python theme={null}
  import requests

  response = requests.get(
      "https://platform.chamelio.ai/.well-known/oauth-protected-resource"
  )
  print(response.json())
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch(
    'https://platform.chamelio.ai/.well-known/oauth-protected-resource'
  );

  const metadata = await response.json();
  console.log(metadata);
  ```
</CodeGroup>

### Success Response

**Status Code:** `200 OK`

```json theme={null}
{
  "resource": "https://platform.chamelio.ai",
  "authorization_servers": ["https://platform.chamelio.ai"],
  "scopes_supported": ["workflows:read", "workflows:write", "tasks:read", "tasks:write", "files:read", "users:read", "users:write", "sor:read", "sor:write", "clickwrap:read", "clickwrap:write", "..."],
  "bearer_methods_supported": ["header"]
}
```

`scopes_supported` is abbreviated above, exactly as in the authorization server document.

### Response Fields

| Field                      | Type   | Description                                                                                                     |
| -------------------------- | ------ | --------------------------------------------------------------------------------------------------------------- |
| `resource`                 | string | The protected resource's identifier                                                                             |
| `authorization_servers`    | array  | Authorization servers that can issue tokens for this resource                                                   |
| `scopes_supported`         | array  | Every scope in the registry                                                                                     |
| `bearer_methods_supported` | array  | Always `["header"]` - tokens must be sent in the `Authorization` header, not as a query parameter or form field |

## Notes

<Info>
  Chamelio is both the authorization server and the protected resource, so `issuer`, `resource`, and
  `authorization_servers` all point at the same origin.
</Info>

## Use Cases

* **OAuth client libraries** - Let a library configure its endpoints from metadata
* **Environment portability** - Resolve endpoints per environment instead of hardcoding them
* **Capability checks** - Confirm the supported grants and PKCE methods before implementing a flow