Remediation
`/.well-known/oauth-protected-resource` is published per RFC 9728 so agents can discover required scopes and authorization servers programmatically.
discoverability.oauth_protected_resourcediscoverabilityweight 1deterministic
Why it matters
`/.well-known/oauth-protected-resource` is published per RFC 9728 so agents can discover required scopes and authorization servers programmatically.
Underlying specification: https://datatracker.ietf.org/doc/html/rfc9728
How to fix
- See the full check definition in the rubric (linked above) for the canonical reference.
- Read the underlying specification at https://datatracker.ietf.org/doc/html/rfc9728.
Run a scan to check your site
Verify on your site
Run a scan against your domain to see whether discoverability.oauth_protected_resource currently passes, warns, or fails. Free, no signup; the score page is permanent and citable.