Service Documentation

BrandPresence API docs for the remote MCP boundary.

These endpoints document the scoped remote MCP integration. They are published for agent discovery and operational clarity; access is read-only unless an owner or admin explicitly grants a supported management scope.

Scope

Homepage responses advertise this documentation page with an RFC 8288 Link header using the registered service-doc relation.

The remote MCP boundary is organization-scoped and read-only by default. Write scopes remain subject to current role, entitlement, feature, usage, evidence, lifecycle and audit checks. Review authentication and consent before connecting.

GET/.well-known/oauth-protected-resource/mcp

Discover MCP protected-resource metadata

Publishes the canonical MCP resource audience, authorization server and supported read scopes.

Auth: Public discovery document.

GET/.well-known/oauth-authorization-server

Discover the MCP OAuth authorization server

Publishes authorization, token, registration and revocation endpoints plus PKCE and grant support.

Auth: Public discovery document.

POST/oauth/register

Register a public remote MCP client

Registers exact HTTPS or loopback redirect URIs for a public OAuth client. No client secret is issued.

Auth: Public, durably rate-limited Dynamic Client Registration.

GET/oauth/authorize

Request organization-scoped MCP authorization

Authenticates an invited BrandPresence owner/admin, displays consent, and issues a short-lived authorization code bound to PKCE S256 and the exact MCP resource.

Auth: BrandPresence browser session plus explicit owner/admin consent.

POST/oauth/token

Exchange or refresh an MCP OAuth token

Exchanges a one-time PKCE authorization code or rotating refresh token for a one-hour audience-bound access token.

Auth: Public OAuth client using form-urlencoded input; no client secret.

POST/oauth/revoke

Revoke an MCP OAuth token

Revokes an OAuth access token or the complete rotating refresh-token family.

Auth: Registered public OAuth client using form-urlencoded input.

POST/mcp

Call the scoped remote MCP server

Handles one bounded JSON-RPC message over stateless Streamable HTTP and exposes read tools plus separately consented, role-checked management tools.

Auth: Authorization: Bearer on every request. Browser session cookies are ignored.