{
    "issuer": "https://fewo-tremmel.de",
    "authorization_endpoint": "https://fewo-tremmel.de/api/oauth/authorize",
    "token_endpoint": "https://fewo-tremmel.de/api/oauth/token",
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "none"
    ],
    "grant_types_supported": [
        "client_credentials",
        "authorization_code"
    ],
    "response_types_supported": [
        "code"
    ],
    "response_modes_supported": [
        "query"
    ],
    "code_challenge_methods_supported": [
        "S256"
    ],
    "authorization_response_iss_parameter_supported": true,
    "scopes_supported": [
        "communication:chat",
        "search:read",
        "erp:read",
        "erp:write",
        "reports:run",
        "audit:read",
        "commerce:order",
        "timetracking:read",
        "pii.pseudonymized:read",
        "dev.ucp.shopping.checkout:manage"
    ],
    "revocation_endpoint": "https://fewo-tremmel.de/api/oauth/revoke",
    "revocation_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post",
        "none"
    ],
    "introspection_endpoint": "https://fewo-tremmel.de/api/agent-auth/introspect",
    "service_documentation": "https://fewo-tremmel.de/.well-known/auth.md",
    "protected_resources": [
        "https://fewo-tremmel.de"
    ],
    "x-itt-client-credentials": {
        "client_id": "itt_agt_<8hex> — the public half of the agent key",
        "client_secret": "the full agent key itt_agt_<8hex>.<48hex>",
        "access_token": "the same agent key; expires_in follows the key's access period, no second token store",
        "scope": "optional; may only narrow (subset check), never widen; the response reports the key's real scopes",
        "tenant": "a key is only accepted by the authorization server of its own tenant host",
        "obtain_key": "https://fewo-tremmel.de/api/agents/catalog"
    },
    "x-itt-identity-linking": {
        "specification": "UCP identity linking 2026-08-25: RFC 6749 §4.1 authorization code + RFC 7636 PKCE (S256 only) + RFC 9207 iss",
        "authorization_endpoint": "https://fewo-tremmel.de/api/oauth/authorize",
        "client_registration": "clients are registered by the site admin (POST /api/agent-auth/oauth-clients); no dynamic registration",
        "client_authentication": "public clients: none (PKCE); confidential clients: client_secret_basic or client_secret_post",
        "redirect_uri": "exact string match; loopback 127.0.0.1 / [::1] ignores the port",
        "access_token": "opaque bearer bound to issuer origin, client, signed-in user and tenant; expires (no refresh token); RFC 7009 revocable",
        "resource": "https://fewo-tremmel.de/api/ucp and /api/acp quote/read/cancel (shared linked-commerce boundary)"
    }
}