u

docs/api/routes/.well-known/oauth-authorization-server.md

@@ -0,0 +1,15 @@
+# `GET /.well-known/oauth-authorization-server`
+
+Public. No cookie required.
+
+OAuth 2.0 Authorization Server Metadata (RFC 8414)
+
+Returns OAuth 2.0 authorization server endpoints and capabilities.
+
+## Response `200`
+
+Authorization Server Metadata
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/.well-known/oauth-protected-resource.md

@@ -0,0 +1,15 @@
+# `GET /.well-known/oauth-protected-resource`
+
+Public. No cookie required.
+
+OAuth 2.0 Protected Resource Metadata (RFC 9728)
+
+Returns protected resource metadata discovering the authorization server for the MCP endpoint.
+
+## Response `200`
+
+Protected Resource Metadata
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/mcp.md

@@ -0,0 +1,21 @@
+# `POST /mcp`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Model Context Protocol (MCP) Streamable HTTP endpoint
+
+Handles MCP JSON-RPC protocol requests and streamable sessions. Protected by Bearer token authorization.
+
+## Response `200`
+
+MCP JSON-RPC response
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 401 | Missing or invalid authorization token |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/oauth/authorize.md

@@ -0,0 +1,32 @@
+# `GET /oauth/authorize`
+
+Public. No cookie required.
+
+OAuth 2.1 Authorization Endpoint (RFC 6749 & RFC 7636)
+
+Authorization prompt for end-users to grant access to an MCP client.
+
+## Query parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `client_id` | yes | string |  |
+| `redirect_uri` | yes | string |  |
+| `response_type` | yes | string |  |
+| `code_challenge` | yes | string |  |
+| `code_challenge_method` | yes | string |  |
+| `state` | no | string |  |
+
+## Response `200`
+
+Authorization / Consent HTML form
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 302 | Redirect back to client callback |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/oauth/introspect.md

@@ -0,0 +1,15 @@
+# `POST /oauth/introspect`
+
+Public. No cookie required.
+
+OAuth 2.0 Token Introspection (RFC 7662)
+
+Verifies the validity of an issued access token.
+
+## Response `200`
+
+Token status and metadata
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/oauth/register.md

@@ -0,0 +1,31 @@
+# `POST /oauth/register`
+
+Public. No cookie required.
+
+Dynamic Client Registration (RFC 7591)
+
+Registers a new OAuth MCP client dynamically.
+
+## Body (JSON)
+
+| Field | Required | Type | Description |
+|-------|----------|------|-------------|
+| `client_name` | no | string |  |
+| `redirect_uris` | yes | string[] |  |
+
+```json
+{
+  "client_name": "…",
+  "redirect_uris": [
+    "…"
+  ]
+}
+```
+
+## Response `201`
+
+Registered client credentials
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/oauth/token.md

@@ -0,0 +1,30 @@
+# `POST /oauth/token`
+
+Public. No cookie required.
+
+OAuth 2.1 Token Endpoint (RFC 6749 & RFC 7636)
+
+Exchanges authorization code with PKCE for an access token, or refreshes an expired token.
+
+## Body
+
+`application/x-www-form-urlencoded`
+
+```json
+{
+  "grant_type": "authorization_code",
+  "code": "…",
+  "redirect_uri": "…",
+  "client_id": "…",
+  "code_verifier": "…",
+  "refresh_token": "…"
+}
+```
+
+## Response `200`
+
+Issued access token and refresh token
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._