# Retrieve authorization server metadata

OAuth2 authorization server metadata (RFC 8414).
Lists the authorization, token, registration, and revocation endpoints along with the supported scopes, grant types, client authentication methods, and PKCE code challenge methods.
Clients can discover the server's capabilities instead of hard-coding them.

Endpoint: GET /.well-known/oauth-authorization-server
Version: 1.1.0

## Response 200:

  - `200` (unknown)
    Authorization server metadata.

## Response 200 fields (application/json):

  - `issuer` (string, required)
    The authorization server's issuer identifier.

  - `authorization_endpoint` (string, required)

  - `token_endpoint` (string, required)

  - `registration_endpoint` (string)
    Dynamic client registration endpoint (RFC 7591).

  - `revocation_endpoint` (string)
    Token revocation endpoint (RFC 7009).

  - `scopes_supported` (array)

  - `response_types_supported` (array, required)

  - `response_modes_supported` (array)

  - `grant_types_supported` (array)

  - `token_endpoint_auth_methods_supported` (array)

  - `revocation_endpoint_auth_methods_supported` (array)

  - `code_challenge_methods_supported` (array)
    PKCE code challenge methods supported (RFC 7636).

  - `authorization_response_iss_parameter_supported` (boolean)
    Whether authorization responses carry the `iss` parameter (RFC 9207).

  - `service_documentation` (string)

## Response 404:

  - `404` (unknown)
    Resource not found.

## Response 404 fields (application/problem+json):

  - `type` (string, required)
    URI reference that identifies the problem type.

  - `title` (string, required)
    Short summary of the problem type.

  - `status` (integer, required)
    HTTP status code generated by the origin server for this occurrence of the problem.

  - `instance` (string)
    URI reference that identifies the specific occurrence of the problem, e.g. by adding a fragment identifier or sub-path to the problem type.
Can be used to locate the root of this problem in the source code.
    Example: /some/uri-reference#specific-occurrence-context

  - `details` (object)
    Additional error details.

## Response 500:

  - `500` (unknown)
    Unexpected server error, reported with the `server_error` error code.

## Response 500 fields (application/json):

  - `error` (string, required)
    Machine-readable error code.
    Enum: "invalid_request", "invalid_client", "invalid_grant", "unauthorized_client", "unsupported_grant_type", "unsupported_response_type", "invalid_scope", "invalid_client_metadata", "invalid_redirect_uri", "invalid_token", "access_denied", "server_error"

  - `error_description` (string)
    Human-readable explanation of the error.

## Response 200 examples:

  - `Metadata` (unknown)

## Response 404 examples:

  - `No resource at this path` (unknown)

  - `No menu item with this ID` (unknown)

  - `No order with this ID` (unknown)

## Response 500 examples:

  - `Unexpected server error` (unknown)