Get the protected resource metadata
OAuth 2.0 Protected Resource Metadata (RFC 9728): the identity providers whose access tokens the Runtime API accepts (the identity file's trusted issuers) and their scopes. Nylorun is never the authorization server: a client signs in at one of authorization_servers and presents its token as Authorization: Bearer. A 401 from the Runtime API names this document in WWW-Authenticate (resource_metadata). Needs no key or Nylorun-Protocol, and accepts an Origin.
The metadata
application/json- response
resource*stringThe Runtime API: NYLORUN_PUBLIC_URL, else the origin the request reached
authorization_servers*array<string>The identity file's issuers, in its order: a client usually signs in at the first
scopes_supported*array<string>The scopes the issuers' tokens may carry, studio aside
bearer_methods_supported*array<>resource_name*stringcurl -X GET "https://example.com/.well-known/oauth-protected-resource"{ "resource": "string", "authorization_servers": [ "string" ], "scopes_supported": [ "string" ], "bearer_methods_supported": [ "header" ], "resource_name": "string"}Get who the caller is GET
The subject, scopes and Agent grants of the credential that sends it: an application key (alone or acting for a subject), a management key (`via: management:<principalId>`, no scopes, no agents), or a trusted issuer's token (`via: issuer:<name>`).
Get the public keys the Runtime's tokens are signed with GET
A JSON Web Key Set, to verify a token the Runtime signed without calling it. No credential is needed.