Struct OauthProtectedResourceMetadata 

pub struct OauthProtectedResourceMetadata {

    pub resource: Url,
    pub authorization_servers: Vec<Url>,
    pub jwks_uri: Option<Url>,
    pub scopes_supported: Option<Vec<String>>,
    pub bearer_methods_supported: Option<Vec<String>>,
    pub resource_signing_alg_values_supported: Option<Vec<String>>,
    pub resource_name: Option<String>,
    pub resource_documentation: Option<String>,
    pub resource_policy_uri: Option<Url>,
    pub resource_tos_uri: Option<Url>,
    pub tls_client_certificate_bound_access_tokens: Option<bool>,
    pub authorization_details_types_supported: Option<Vec<String>>,
    pub dpop_signing_alg_values_supported: Option<Vec<String>>,
    pub dpop_bound_access_tokens_required: Option<bool>,
}

represents metadata about a protected resource in the OAuth 2.0 ecosystem. It allows clients and authorization servers to discover how to interact with a protected resource (like an MCP endpoint), including security requirements and supported features. https://datatracker.ietf.org/doc/rfc9728

Fields

resource: Url

The base identifier of the protected resource (e.g., an MCP server’s URI). This is the only required field.

authorization_servers: Vec<Url>

List of authorization servers that can issue access tokens for this resource. Allows dynamic trust discovery.

jwks_uri: Option<Url>

URL where the resource exposes its public keys (JWKS) to verify signed tokens. Typically used to verify JWT access tokens. Example: https://example.com/.well-known/jwks.json

scopes_supported: Option<Vec<String>>

OAuth scopes the resource supports (e.g., “mcp:tool”, “read”, “write”, “admin”). Helps clients know what they can request for access.

bearer_methods_supported: Option<Vec<String>>

Methods accepted for presenting Bearer tokens: authorization_header (typical) form_post uri_query

resource_signing_alg_values_supported: Option<Vec<String>>

Supported signing algorithms for access tokens (if tokens are JWTs). Example: [“RS256”, “ES256”]

resource_name: Option<String>

A human-readable name for the resource. Useful for UIs, logs, or developer documentation.

resource_documentation: Option<String>

URL to developer docs describing the resource and how to use it.

resource_policy_uri: Option<Url>

URL to the resource’s access policy or terms (e.g., rules on who can access what).

resource_tos_uri: Option<Url>

URL to terms of service applicable to this resource.

tls_client_certificate_bound_access_tokens: Option<bool>

If true, access tokens must be bound to a client TLS certificate. Used in mutual TLS scenarios for additional security.

authorization_details_types_supported: Option<Vec<String>>

Lists structured authorization types supported (used with Rich Authorization Requests (RAR) Example: [“payment_initiation”, “account_information”]

dpop_signing_alg_values_supported: Option<Vec<String>>

Supported algorithms for DPoP (Demonstration of Proof-of-Possession) tokens. Example: [“ES256”, “RS256”]

dpop_bound_access_tokens_required: Option<bool>

If true, the resource requires access tokens to be DPoP-bound. Enhances security by tying tokens to a specific client and key.

Implementations

impl OauthProtectedResourceMetadata

pub fn new<S>( resource: S, authorization_servers: Vec<S>, scopes_supported: Option<Vec<String>>, ) -> Result<Self, ParseError>

where S: AsRef<str>,

Creates a new OAuthProtectedResourceMetadata instance with only the minimal required fields populated.

The resource and each entry in authorization_servers must be valid URLs. All other metadata fields are initialized to their defaults. To provide optional or extended metadata, assign those fields after creation or construct the struct directly.

Trait Implementations

impl Clone for OauthProtectedResourceMetadata

fn clone(&self) -> OauthProtectedResourceMetadata

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OauthProtectedResourceMetadata

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OauthProtectedResourceMetadata

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OauthProtectedResourceMetadata

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.