sealgate-ai OAUTH Server API

openapi: 3.2.0
info:
  title: SealGate OAUTH Server API
  description: Open-source MCP security, aggregation, and monitoring. Self-hosted MCP proxy.
  version: 0.19.0
tags:
- name: oauth-server
paths:
  /.well-known/oauth-authorization-server/mcp:
    get:
      tags:
      - oauth-server
      summary: Oauth Metadata
      description: 'Serve whichever discovery document matches the requested path.


        Documents are derived from the request''s own origin, so the ``resource``

        value matches the host the user typed (RFC 9728 requires an exact match) and

        a single-origin self-hosted deployment needs no configuration.'
      operationId: oauth_metadata__well_known_oauth_authorization_server_mcp_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /.well-known/oauth-authorization-server:
    get:
      tags:
      - oauth-server
      summary: Oauth Metadata
      description: 'Serve whichever discovery document matches the requested path.


        Documents are derived from the request''s own origin, so the ``resource``

        value matches the host the user typed (RFC 9728 requires an exact match) and

        a single-origin self-hosted deployment needs no configuration.'
      operationId: oauth_metadata__well_known_oauth_authorization_server_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /.well-known/oauth-protected-resource/mcp:
    get:
      tags:
      - oauth-server
      summary: Oauth Metadata
      description: 'Serve whichever discovery document matches the requested path.


        Documents are derived from the request''s own origin, so the ``resource``

        value matches the host the user typed (RFC 9728 requires an exact match) and

        a single-origin self-hosted deployment needs no configuration.'
      operationId: oauth_metadata__well_known_oauth_protected_resource_mcp_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /oauth/authorize:
    get:
      tags:
      - oauth-server
      summary: Authorize
      description: 'Validate an authorization request and hand the browser to consent.


        Advertised on the dashboard origin (see ``metadata.py``) because the consent

        screen needs the user''s GoTrue session, which is per-origin.'
      operationId: authorize_oauth_authorize_get
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /oauth/token:
    post:
      tags:
      - oauth-server
      summary: Token
      description: 'Exchange a code, or rotate a refresh token.


        Reads ``application/x-www-form-urlencoded`` as RFC 6749 §4.1.3 requires -

        Claude sends both the initial exchange and every refresh this way, and a

        JSON-only parser here returns 415 and breaks every connection.'
      operationId: token_oauth_token_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /oauth/register:
    post:
      tags:
      - oauth-server
      summary: Register
      description: 'RFC 7591 dynamic client registration.


        JSON-bodied, unlike ``/oauth/token`` - RFC 7591 §3.1 - so the two endpoints

        deliberately do not share a parser.'
      operationId: register_oauth_register_post
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema: {}
  /oauth/revoke:
    post:
      tags:
      - oauth-server
      summary: Revoke
      description: 'RFC 7009 revocation. Always 200, even for an unknown token.


        Confirming whether a token exists would let an unauthenticated caller probe

        for valid credentials, and RFC 7009 §2.2 requires success either way.'
      operationId: revoke_oauth_revoke_post
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema: {}
components:
  securitySchemes:
    HTTPBearer:
      type: http
      scheme: bearer
    ClientBearer:
      type: http
      description: Opaque ewc_ client installation credential
      scheme: bearer
    ServiceToken:
      type: http
      description: 'A SealGate service token: `sgt_acct_...` (account token) or `sgt_org_...` (org token). Mint an account token in the dashboard.'
      scheme: bearer
    MCPGatewayOAuth:
      type: oauth2
      description: OAuth 2.1 authorization-code flow (PKCE required) against the SealGate MCP gateway's authorization server. Request only the scopes an agent needs; unrequested scopes are not granted.
      flows:
        authorizationCode:
          authorizationUrl: /oauth/authorize
          tokenUrl: /oauth/token
          refreshUrl: /oauth/token
          scopes:
            mcp: Connect to the MCP gateway and call the tools exposed by your enabled servers. Every call is still evaluated by the policy engine.
            offline_access: Issue a refresh token so the client can renew access without a new browser sign-in.