> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Protected-resource metadata

> Advertises the MCP resource and its authorization server. HTTPS is required outside loopback development.

No signed-in session is required. Endpoint-specific tokens, setup secrets or challenges may still be required.

Advertises the MCP resource and its authorization server. HTTPS is required outside loopback development.

[Request conventions](/api-reference/overview) · [API keys](/api-keys) · [MCP connections](/mcp-connections)


## OpenAPI

````yaml api-reference/openapi.json GET /.well-known/oauth-protected-resource
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.0
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /.well-known/oauth-protected-resource:
    get:
      tags:
        - OAuth and MCP transport
      summary: Protected-resource metadata
      description: >-
        Advertises the MCP resource and its authorization server. HTTPS is
        required outside loopback development.


        No signed-in session is required. Endpoint-specific tokens, setup
        secrets or challenges may still be required.
      operationId: get_well_known_oauth_protected_resource
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  resource:
                    type: string
                  authorization_servers:
                    type: array
                    items:
                      type: string
                  scopes_supported:
                    type: array
                    items:
                      type: string
                  bearer_methods_supported:
                    type: array
                    items:
                      type: string
                  resource_name:
                    type: string
                additionalProperties: true
              example:
                resource: https://posted-api.example.test/mcp
                authorization_servers:
                  - https://posted-api.example.test
                scopes_supported:
                  - read
                  - write
                  - admin
                bearer_methods_supported:
                  - header
                resource_name: Posted MCP
        default:
          description: >-
            Request failure. Inspect code, message and requestId; respect
            Retry-After on HTTP 429.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
            - requestId
          properties:
            code:
              type: string
            message:
              type: string
            requestId:
              type: string

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.