Methodology
OAuth protected resource
ia.oauth-protected-resource · 5.13
Act
SHOULD
Scanner data
AR-ACT-01
Why it matters
OAuth Protected Resource Metadata (RFC 9728) tells agents which authorization servers issue tokens for your APIs.
How to fix it
Publish /.well-known/oauth-protected-resource with the resource and its authorization servers.
-
Serve the RFC 9728 metadata.
{ "resource": "https://api.example.com", "authorization_servers": ["https://example.com"], "bearer_methods_supported": ["header"] } -
Return WWW-Authenticate with resource_metadata on 401 responses.
Verify
curl -sf https://{domain}/.well-known/oauth-protected-resource | jq -e '.resource and .authorization_servers'
Expected: exit code 0
Run a new scan for this checkpoint:
isagentready results {domain} --checkpoint ia.oauth-protected-resource
Details Mapping, lifecycle and references
- AR mapping
- Full match
- Evidence source
- agentready.org AR-ACT-01
- Score role
- Bonus
- Introduced
- 2026-08-24
- Methodology version
- 2026-10-22