# Get protected resource metadata

OAuth 2.0 protected resource metadata (RFC 9728) of API V3: the resource identifier,
the authorization server that issues tokens for it, and the scopes it accepts. The
path follows RFC 9728 §3.1: the well-known suffix is inserted between the host and
the path of the resource identifier `https://api.alteg.io/api/v3`. A `401` from
`/api/v3` points here in `WWW-Authenticate: Bearer resource_metadata="..."`.

Endpoint: GET /.well-known/oauth-protected-resource/api/v3
Version: 3.0.0-preview

## Response 200:

  - `200` (unknown)
    Protected resource metadata.

## Response 200 fields (application/json):

  - `resource` (string, required)
    Resource identifier, also the audience of tokens accepted here.

  - `authorization_servers` (array, required)

  - `scopes_supported` (array)

  - `bearer_methods_supported` (array)

## Response 200 headers (application/json):

  - `X-Request-Id` (string)
    Request identifier for support and log correlation.

  - `Cache-Control` (string)
    Public metadata may be cached briefly; clients should revalidate before long-lived use.
    Example: public, max-age=3600

## Response 429:

  - `429` (unknown)
    Too many metadata requests from this address. Metadata is cacheable — honour
`Cache-Control` instead of polling. Retry after the interval in `Retry-After`.

## Response 429 fields (application/json):

  - `error` (string, required)
    OAuth error code (`invalid_request`, `invalid_grant`, `invalid_client`, ...).

  - `error_description` (string)

## Response 429 headers (application/json):

  - `Retry-After` (integer)
    Seconds to wait before retrying.
    Example: 60

## Response 500:

  - `500` (unknown)
    Metadata document cannot be generated (OAuth error object).

## Response 500 fields (application/json):

  - `error` (string, required)
    OAuth error code (`invalid_request`, `invalid_grant`, `invalid_client`, ...).

  - `error_description` (string)