{"id":"ia.oauth-protected-resource","name":"OAuth protected resource","verify":{"command":"curl -sf https://{domain}/.well-known/oauth-protected-resource | jq -e '.resource and .authorization_servers'","rescan":"isagentready results {domain} --checkpoint ia.oauth-protected-resource","expect":"exit code 0"},"fix":{"steps":[{"action":"Serve the RFC 9728 metadata.","order":1,"language":"json","code_example":"{\n  \"resource\": \"https://api.example.com\",\n  \"authorization_servers\": [\"https://example.com\"],\n  \"bearer_methods_supported\": [\"header\"]\n}"},{"action":"Return WWW-Authenticate with resource_metadata on 401 responses.","order":2,"language":null,"code_example":null}],"summary":"Publish /.well-known/oauth-protected-resource with the resource and its authorization servers.","skill":{"name":"security-trust","anchor":"ia.oauth-protected-resource"}},"category":"security","aggregate":null,"references":[{"title":"RFC 9728: OAuth 2.0 Protected Resource Metadata","kind":"spec","url":"https://datatracker.ietf.org/doc/html/rfc9728"}],"stage":"act","lifecycle":{"introduced":"2026-08-24","revised":[],"retired":null,"replaced_by":null},"methodology_version":"2026-10-22","evidence_tier":"emerging","evidence_source":{"title":"agentready.org AR-ACT-01","url":"https://www.agentready.org/#act"},"why":"OAuth Protected Resource Metadata (RFC 9728) tells agents which authorization servers issue tokens for your APIs.","profiles":["api_tool_readiness","agentic_commerce"],"score_role":"bonus","legacy_id":"5.13","i18n":{"nl":{"name":"OAuth protected resource","steps":["Lever de RFC 9728-metadata.","Geef WWW-Authenticate met resource_metadata terug op 401-responses."],"why":"OAuth Protected Resource Metadata (RFC 9728) vertelt agents welke autorisatieservers tokens voor je API's uitgeven.","fix_summary":"Publiceer /.well-known/oauth-protected-resource met de resource en de autorisatieservers.","verify_expect":"exitcode 0"}},"ar_practice_ids":["AR-ACT-01"],"strength":"SHOULD","ar_mapping":"full","evidence_type":"scanner_data","detail_url":"https://isagentready.com/en/methodology/checkpoints/ia.oauth-protected-resource","maturity":"emerging","applicability":{"mode":"detected_surface","condition":null,"surfaces":["auth"]}}