Read OAuth 2.0 Authorization Server Metadata (RFC 8414) for the token exchange

The approved contract does not provide a longer purpose statement for this operation.

App

Vision Core

Contract

Platform API 1.0.0-preview.8

Lifecycle

preview

Runtime

acceptance-gated

Operation ID

getAuthorizationServerMetadata

Canonical origin

https://app.runonvision.com

Purpose and use cases

Read OAuth 2.0 Authorization Server Metadata (RFC 8414) for the token exchange

The owning App is Vision Core. Vision owns machine identity and common API policy. Source Apps retain their resource and business authority.

Business use cases and out-of-scope behavior are not yet declared in the approved OpenAPI description.

Request

GET https://app.runonvision.com/.well-known/oauth-authorization-server

Authentication and authorization

No authentication requirement is declared for this operation.

Headers

• Accept: application/json — recommended where a JSON response is declared.

Undeclared tracing, idempotency, conditional-request, and version headers are not assumed on this page.

Path and query parameters

This operation declares no path or query parameters.

Request body

This operation declares no request body.

Runnable examples

curl 'https://app.runonvision.com/.well-known/oauth-authorization-server' \
  --request GET \
  --header 'accept: application/json'

const response = await fetch('https://app.runonvision.com/.well-known/oauth-authorization-server', {
  method: 'GET',
  headers: {
    accept: 'application/json',
  },
}

if (!response.ok) throw new Error(`Vision API ${response.status}`)
const result = await response.json()

import json
import urllib.parse
import urllib.request

request = urllib.request.Request(
    'https://app.runonvision.com/.well-known/oauth-authorization-server',
    data=None,
    headers={
    "Accept": "application/json"
},
    method='GET',
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)

The current TypeScript reference client covers Platform token exchange and core reads. No native SDK helper is declared for this operation; use the HTTP contract directly and follow the SDK guidance.

Responses

Success response schema

{
  "issuer": "<issuer>",
  "token_endpoint": "<token_endpoint>",
  "jwks_uri": "<jwks_uri>",
  "grant_types_supported": [
    "client_credentials"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic"
  ],
  "response_types_supported": [
    "<not specified>"
  ]
}

Errors and troubleshooting

Error bodies and codes are shown only where the approved contract declares them. Use status, the declared error schema, and any correlation identifier returned by the App; do not infer that two Apps share one envelope.

• 404 — Token exchange is not available on this installation, or its issuer is not a bare https origin (RFC 8414 requires the metadata issuer to equal the origin it is served from)

Collection behavior

Pagination: not declared. Filtering/search: not declared. Sorting: not declared.

Cursor lifetime, cursor binding, stable ordering, maximum traversal, and unknown-filter behavior are not assumed unless stated by a parameter description or schema constraint above.

Operational behavior

• Rate limit: No operation-specific limit or 429 response is declared.
• Retry: Retry only when the documented error model or response headers authorize it. Timeout and backoff values are not declared by this operation.
• Idempotency: No idempotency header or replay window is declared.
• Concurrency: No ETag, If-Match, or optimistic-version header is declared.

Security and privacy

• Keep client credentials and bearer tokens on trusted servers.
• Send only to the exact approved HTTPS origin and audience.
• Treat response data according to the owning App's classification and retention policy; the OpenAPI contract does not itself grant data access.
• Do not log credentials, tokens, complete private payloads, or secrets.

Edge cases and known documentation gaps

• No detailed operation description.
• Business roles, timeout, retry budget, rate value, idempotency window, and concurrency behavior are absent unless explicitly stated above.

Related operations and workflows

• GET /.well-known/jwks.json — Read active public token verification keys
• GET /.well-known/vision-app-notices-jwks.json — Internal: keys for Core-to-App machine-actor notices

Contract history and evidence

• Contract version: 1.0.0-preview.8
• Approved snapshot SHA-256: e696d48690f5bd5983b044fb77eff04f29d112a51fe150409c1542386d1b74d3
• Approval: Anthony, 2026-11-03T01:23:27.515Z (anthony-docs-live-20261102)
• Download the authoritative OpenAPI 3.1 snapshot