> ## Documentation Index > Fetch the complete documentation index at: https://developers.nexspace365.com/llms.txt > Use this file to discover all available pages before exploring further. # Protected-resource metadata (RFC 9728) > OAuth 2.0 Protected Resource Metadata for the MCP resource. MCP clients read this to learn which authorization server issues tokens for `/mcp` and which scopes it supports. Unauthenticated — it is fetched before any credential exists. A `401` from an MCP endpoint carries `WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp"`, so a client can bootstrap the whole OAuth flow from the challenge alone. Unlike `/.well-known/mcp`, this path is **not** matched by the MCP host guard, so it is reachable on the API host too. ## OpenAPI ````yaml https://api.nexspace365.com/api/openapi.json get /.well-known/oauth-protected-resource openapi: 3.0.3 info: title: NexSpace 365 API description: > Multi-industry enterprise workforce management platform — scheduling, HR, payroll, CRM, AI, and messaging suites. ## Authentication Four credentials, all but the first sent as `Authorization: Bearer `: session cookie, JWT bearer, API key (`nex_live_…` / `nex_test_…` / `nex_pat_…`), and OAuth 2.1 access token. AI agents should use an API key or an OAuth token with the appropriate scopes. ## Authorization Endpoints require specific permissions via the RBAC system: - **Internal team**: Full platform access - **Facility users**: Scoped to their org/facilities - **Staff**: Limited to own data ## Error Contract All errors return `{ error: { message, code?, suggestion?, retryable? }, requestId? }`. The `suggestion` field hints at how to fix the request; `retryable` signals whether retry-with-backoff is appropriate. ## Versioning Pin your integration to a specific API version via the `NexSpace-Version` header (date-based, e.g. `2026-05-10`). When absent, the latest version is assumed. Deprecated versions include `Sunset` and `Deprecation` headers. Discovery at `GET /.well-known/api-versions`. ## Idempotency Write operations (POST/PUT/PATCH) accept an `Idempotency-Key` header. If the same key + body combination is sent again within 24 hours, the original response is replayed. Different body with the same key returns 409 Conflict. ## MCP (Model Context Protocol) AI agents interact via `POST /mcp` using JSON-RPC 2.0. Call `tools/list` to discover available verbs, then `tools/call` to invoke them. MCP is served on its own host — `https://mcp.nexspace365.com`, not the API host. `api.nexspace365.com` rejects `/mcp`, `/mcp/*` and `/.well-known/mcp` with `403 MCP_HOST_NOT_ALLOWED`, and those operations pin the correct host with an operation-level `servers` override. The `/.well-known/oauth-protected-resource*` operations are also tagged MCP but are **not** covered by the host guard — they answer on either host. version: 1.0.0 contact: name: NexSpace email: admin@nexspace365.com license: name: MIT url: https://opensource.org/licenses/MIT servers: - url: https://api.nexspace365.com description: Production server security: - bearerAuth: [] - apiKeyAuth: [] tags: - name: Authentication description: User authentication and session management - name: Facilities description: Facility management - name: Staff description: Staff member management and profiles - name: Credentials description: Staff credential tracking — licenses, certifications, and training - name: Shifts description: Shift scheduling and management - name: Agents description: Headless agent runs, human-in-the-loop approvals, and automation triggers. - name: Dashboard description: Dashboard statistics and widgets - name: API Keys description: API key lifecycle — create, list, revoke, rotate - name: MCP description: Model Context Protocol endpoint for AI agent tool calling - name: OAuth description: OAuth 2.1 authorization server — DCR, authorize, token - name: Webhooks description: Outbound webhook subscription management - name: Analytics description: API usage analytics and observability - name: Sandbox description: Sandbox (`nex_test_`) data lifecycle for the same production host - name: Platform description: Version discovery and platform metadata. paths: /.well-known/oauth-protected-resource: get: tags: - MCP summary: Protected-resource metadata (RFC 9728) description: >- OAuth 2.0 Protected Resource Metadata for the MCP resource. MCP clients read this to learn which authorization server issues tokens for `/mcp` and which scopes it supports. Unauthenticated — it is fetched before any credential exists. A `401` from an MCP endpoint carries `WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp"`, so a client can bootstrap the whole OAuth flow from the challenge alone. Unlike `/.well-known/mcp`, this path is **not** matched by the MCP host guard, so it is reachable on the API host too. operationId: getProtectedResourceMetadata responses: '200': $ref: '#/components/responses/ProtectedResourceMetadata' security: [] components: responses: ProtectedResourceMetadata: description: RFC 9728 protected-resource metadata for the MCP resource. content: application/json: schema: type: object properties: resource: type: string description: Canonical resource URL — the request's base URL plus `/mcp`. authorization_servers: type: array items: type: string description: Issuers that can mint tokens for this resource. scopes_supported: type: array items: type: string description: The headless scope catalog (`HEADLESS_KNOWN_SCOPES`). bearer_methods_supported: type: array items: type: string resource_name: type: string example: resource: https://mcp.nexspace365.com/mcp authorization_servers: - https://api.nexspace365.com bearer_methods_supported: - header securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT token authentication apiKeyAuth: type: http scheme: bearer bearerFormat: NexSpaceApiKey description: | API key or personal access token (NEX-1042). Send as `Authorization: Bearer `. Token format: - `nex_live_…` — live API key (server-to-server) - `nex_test_…` — sandbox API key - `nex_pat_…` — personal access token (acts as the issuing user) Authorization is decided by the key's `scopes` array, not the owning user's RBAC role. See `POST /api/api-keys` to mint a key. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.