Pistis
API referenceM C P

Protected resource metadata for /mcp (RFC 9728)

GET
/.well-known/oauth-protected-resource/mcp

Names /mcp as the resource and this server as its authorization server. Also at /.well-known/oauth-protected-resource. No token.

Response Body

The metadata

application/json
  1. response
resource*string
authorization_servers*array<string>
scopes_supported*array<string>
bearer_methods_supported*array<string>
Example Request
curl -X GET 'http://127.0.0.1:7777/.well-known/oauth-protected-resource/mcp'
Example Response200
{  "resource": "string",  "authorization_servers": [    "string"  ],  "scopes_supported": [    "string"  ],  "bearer_methods_supported": [    "string"  ]}

Delete a role DELETE

Needs People & roles. Refused while anyone has it or an admission rule gives it (409, naming them); Admin and Member never (400).

Authorization server metadata (RFC 8414) GET

Pistis is the authorization server for `/mcp`: authorization code with PKCE S256, Client ID Metadata Documents and dynamic registration, rotating refresh tokens, revocation. No token.