Discover Oidc Endpoints

DiscoverOIDCEndpoints fetches the OpenID Connect discovery document for an issuer and returns the authorization, token, and supported scopes.

POST /api/v1/mcp_servers/discover_oidc

DiscoverOIDCEndpoints

Go

package main

import(
	"context"
	"github.com/conductorone/conductorone-sdk-go/pkg/models/shared"
	conductoronesdkgo "github.com/conductorone/conductorone-sdk-go"
	"log"
)

func main() {
    ctx := context.Background()

    s := conductoronesdkgo.New(
        conductoronesdkgo.WithSecurity(shared.Security{
            BearerAuth: "<YOUR_BEARER_TOKEN_HERE>",
            Oauth: "<YOUR_OAUTH_HERE>",
        }),
    )

    res, err := s.MCPServer.DiscoverOIDCEndpoints(ctx, nil)
    if err != nil {
        log.Fatal(err)
    }
    if res.MCPServerServiceDiscoverOIDCEndpointsResponse != nil {
        // handle response
    }
}

curl --request POST \
  --url https://{tenantDomain}.conductor.one/api/v1/mcp_servers/discover_oidc \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "issuerUrl": "<string>"
}
'

import requests

url = "https://{tenantDomain}.conductor.one/api/v1/mcp_servers/discover_oidc"

payload = { "issuerUrl": "<string>" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({issuerUrl: '<string>'})
};

fetch('https://{tenantDomain}.conductor.one/api/v1/mcp_servers/discover_oidc', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{tenantDomain}.conductor.one/api/v1/mcp_servers/discover_oidc",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'issuerUrl' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

HttpResponse<String> response = Unirest.post("https://{tenantDomain}.conductor.one/api/v1/mcp_servers/discover_oidc")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"issuerUrl\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{tenantDomain}.conductor.one/api/v1/mcp_servers/discover_oidc")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"issuerUrl\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

200

{
  "authorizationEndpoint": "<string>",
  "codeChallengeMethodsSupported": [
    "<string>"
  ],
  "scopesSupported": [
    "<string>"
  ],
  "tokenEndpoint": "<string>"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Authorization · string · header · required

This API uses OAuth2 with the Client Credential flow. Client Credentials must be sent in the BODY, not the headers. For an example of how to implement this, refer to the c1TokenSource.Token() function.

Body

application/json

MCPServerServiceDiscoverOIDCEndpointsRequest fetches the OpenID Connect discovery document for a given issuer URL.

issuerUrl · string

The issuer URL (e.g. "https://accounts.google.com"). The server appends /.well-known/openid-configuration to this URL.

Response

200 - application/json

MCPServerServiceDiscoverOIDCEndpointsResponse returns the discovered OAuth2 endpoints.

MCPServerServiceDiscoverOIDCEndpointsResponse returns the discovered OAuth2 endpoints.

authorizationEndpoint · string

The authorization endpoint URL.

codeChallengeMethodsSupported · string[] | null

PKCE code challenge methods supported by the authorization server (RFC 8414). Typical values: "plain", "S256". Empty when the discovery doc omits this field. The frontend should pass the array back unchanged on save so the backend can persist it on the connector and skip per-flow re-discovery.

scopesSupported · string[] | null

Scopes supported by the authorization server.

tokenEndpoint · string

The token endpoint URL.