Service Documentation

BrandPresence API docs for the remote MCP boundary.

These endpoints document the read-only remote MCP integration. They are published for agent discovery and operational clarity rather than as a general mutation API.

Scope

Homepage responses advertise this documentation page with an RFC 8288 Link header using the registered service-doc relation.

The remote MCP boundary is intentionally read-only and organization-scoped. Review the authentication and consent requirements before connecting a client.

GET/.well-known/oauth-protected-resource/mcp

Discover MCP protected-resource metadata

Publishes the canonical MCP resource audience, authorization server and supported read scopes.

Auth: Public discovery document.

GET/.well-known/oauth-authorization-server

Discover the MCP OAuth authorization server

Publishes authorization, token, registration and revocation endpoints plus PKCE and grant support.

Auth: Public discovery document.

POST/oauth/register

Register a public remote MCP client

Registers exact HTTPS or loopback redirect URIs for a public OAuth client. No client secret is issued.

Auth: Public, durably rate-limited Dynamic Client Registration.

GET/oauth/authorize

Request organization-scoped MCP authorization

Authenticates an invited BrandPresence owner/admin, displays consent, and issues a short-lived authorization code bound to PKCE S256 and the exact MCP resource.

Auth: BrandPresence browser session plus explicit owner/admin consent.

POST/oauth/token

Exchange or refresh an MCP OAuth token

Exchanges a one-time PKCE authorization code or rotating refresh token for a one-hour audience-bound access token.

Auth: Public OAuth client using form-urlencoded input; no client secret.

POST/oauth/revoke

Revoke an MCP OAuth token

Revokes an OAuth access token or the complete rotating refresh-token family.

Auth: Registered public OAuth client using form-urlencoded input.

POST/mcp

Call the read-only remote MCP server

Handles one bounded JSON-RPC message over stateless Streamable HTTP and exposes only read-only tools and resources.

Auth: Authorization: Bearer on every request. Browser session cookies are ignored.