curl --fail-with-body --max-time 30 'https://app.reflections.ai/.well-known/oauth-protected-resource/mcp'import { exit } from "node:process";
const response = await fetch("https://app.reflections.ai/.well-known/oauth-protected-resource/mcp", {
method: "GET",
headers: {
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
from urllib.error import HTTPError
from urllib.request import Request, urlopen
headers = {
}
request = Request("https://app.reflections.ai/.well-known/oauth-protected-resource/mcp",
method="GET", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"time"
)
func main() {
request, err := http.NewRequest("GET", "https://app.reflections.ai/.well-known/oauth-protected-resource/mcp", nil)
if err != nil {
panic(err)
}
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"resource": "https://app.reflections.ai/mcp",
"resource_name": "Reflections Talent API",
"authorization_servers": [
"https://app.reflections.ai"
],
"scopes_supported": [
"talent:read",
"licenses:read",
"checks:write",
"generations:write",
"license_requests:write",
"usage:write"
],
"bearer_methods_supported": [
"header"
],
"resource_documentation": "https://docs.reflections.ai/api-reference/mcp/overview"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Retrieve the MCP server's resource metadata
Planned contract — unavailable in test and live modes. This operation is a protocol reference, not a callable endpoint. Start with the working sandbox quickstart.
Describes the MCP server as an OAuth protected resource, as
RFC 9728 defines: which authorization server issues its tokens and which scopes it accepts.
A request to https://app.reflections.ai/mcp without a valid token gets 401 with a
WWW-Authenticate header whose resource_metadata points here. Public, and served with
Cache-Control: public, max-age=3600.
curl --fail-with-body --max-time 30 'https://app.reflections.ai/.well-known/oauth-protected-resource/mcp'import { exit } from "node:process";
const response = await fetch("https://app.reflections.ai/.well-known/oauth-protected-resource/mcp", {
method: "GET",
headers: {
},
signal: AbortSignal.timeout(30_000),
});
const responseBody = await response.text();
if (!response.ok) {
console.error(`HTTP ${response.status}: ${responseBody}`);
exit(1);
}
console.log(responseBody);
from urllib.error import HTTPError
from urllib.request import Request, urlopen
headers = {
}
request = Request("https://app.reflections.ai/.well-known/oauth-protected-resource/mcp",
method="GET", headers=headers)
try:
with urlopen(request, timeout=30) as response:
print(response.read().decode("utf-8"))
except HTTPError as error:
error_body = error.read().decode("utf-8")
raise RuntimeError(f"HTTP {error.code}: {error_body}") from error
package main
import (
"fmt"
"io"
"net/http"
"time"
)
func main() {
request, err := http.NewRequest("GET", "https://app.reflections.ai/.well-known/oauth-protected-resource/mcp", nil)
if err != nil {
panic(err)
}
client := &http.Client{Timeout: 30 * time.Second}
response, err := client.Do(request)
if err != nil {
panic(err)
}
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
if err != nil {
panic(err)
}
if response.StatusCode < 200 || response.StatusCode >= 300 {
panic(fmt.Sprintf("HTTP %d: %s", response.StatusCode, responseBody))
}
fmt.Print(string(responseBody))
}
{
"resource": "https://app.reflections.ai/mcp",
"resource_name": "Reflections Talent API",
"authorization_servers": [
"https://app.reflections.ai"
],
"scopes_supported": [
"talent:read",
"licenses:read",
"checks:write",
"generations:write",
"license_requests:write",
"usage:write"
],
"bearer_methods_supported": [
"header"
],
"resource_documentation": "https://docs.reflections.ai/api-reference/mcp/overview"
}{
"type": "https://docs.reflections.ai/errors/rate_limited",
"title": "Too many requests",
"status": 429,
"code": "rate_limited",
"request_id": "req_8f2k4m6p8r0t2v4x6z8b0d2f4h"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "invalid_request",
"request_id": "<string>",
"detail": "<string>",
"param": "<string>",
"doc_url": "<string>"
}Response
The protected resource metadata.
OAuth protected resource metadata, as RFC 9728 defines it.
The MCP server's URL.
The issuers whose tokens the server accepts: https://app.reflections.ai.
The scopes the MCP server's tools need.
A scope a person can approve. Connections use all ten. The MCP server accepts
talent:read, licenses:read, checks:write, generations:write,
license_requests:write and usage:write.
talent:read, licenses:read, license_requests:write, files:write, checks:write, generations:write, sessions:write, revocations:write, usage:write, statements:read Always ["header"]: send the token in the Authorization header.
The name MCP clients show.
The MCP server's documentation.