# Feature AI-13 - Implement RFC 9728: OAuth 2.0 Protected Resource Metadata

Project: Stream AI
Status: closed
URL: https://community.openproject.org/work_packages/AI-13

## Planning

| Attribute | Value |
| --- | --- |
| Date | 2025-11-14 – 2026-03-31 |
| Priority | Medium |
| Target versions | Product Backlog |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

| ID | Subject | Type | Status | Assignee | Target versions | Spent time |
| --- | --- | --- | --- | --- | --- | --- |
| AI-15 | Indicate scope in WWW Authenticate | Implementation | closed |  |  |  |
| AI-16 | Add protected resource metadata endpoint | Implementation | closed |  |  |  |
| AI-17 | Indicate resource metadata endpoint in WWW Authenticate header | Implementation | closed |  |  |  |

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module | API, Artificial Intelligence / MCP Server (MCP) |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan | Community (COM) |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Jan Sandbrink |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| Work |  |
| Labor costs |  |

## Description

**As** an MCP client  
**I require OpenProject to** implement RFC 9728,  
**so that** OAuth 2.0 authorization servers and scopes can be dynamically discovered.

**Acceptance criteria**

*   Implement metadata endpoint for each API offered by OpenProject [according to RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728)
    
    *   APIv3
        
    *   SCIM
        
    *   MCP
        
*   The metadata must indicate at least
    
    *   `authorization_servers`
        
    *   `scopes_supported`
        
    *   `bearer_methods_supported`
        
    *   `resource` and `resource_name`
        
    *   Optionally: `resource_documentation`
        
*   Enhance WWW-Authenticate response to indicate:
    
    *   Location of Metadata document for relevant API
        
    *   scopes required for current request
        

**Permissions and visibility considerations**

*   To everyone, even/especially unauthenticated clients