Skip to main content
GET
cURL

Response

The authorization server metadata.

OAuth authorization server metadata, as RFC 8414 defines it.

issuer
string<uri>
required

The issuer, https://app.reflections.ai. It equals the iss on every authorization response.

authorization_endpoint
string<uri>
required

The authorization page.

token_endpoint
string<uri>
required

The token endpoint.

response_types_supported
string[]
required

Always ["code"].

grant_types_supported
string[]
required

The grants the token endpoint accepts.

code_challenge_methods_supported
string[]
required

Always ["S256"].

registration_endpoint
string<uri>

The client registration endpoint.

introspection_endpoint
string<uri>

The introspection endpoint, for RSL content hosts.

revocation_endpoint
string<uri>

The revocation endpoint.

scopes_supported
enum<string>[]

Every scope a client may ask for.

A scope a person can approve. Connections use all ten. The MCP server accepts talent:read, licenses:read, checks:write, generations:write, license_requests:write and usage:write.

Available options:
talent:read,
licenses:read,
license_requests:write,
files:write,
checks:write,
generations:write,
sessions:write,
revocations:write,
usage:write,
statements:read
response_modes_supported
string[]

Always ["query"].

token_endpoint_auth_methods_supported
string[]

How clients authenticate at the token endpoint.

introspection_endpoint_auth_methods_supported
string[]

How clients authenticate at the introspection endpoint.

revocation_endpoint_auth_methods_supported
string[]

How clients authenticate at the revocation endpoint.

authorization_response_iss_parameter_supported
boolean

true: every authorization response carries iss (RFC 9207).

client_id_metadata_document_supported
boolean

true: a client may use the HTTPS URL of its metadata document as its client_id.

service_documentation
string<uri>

These docs.