Sarj AI Developer API OAuth Scopes

generated: '2026-08-09'
method: probed
source: https://platform-api.sarj.ai/.well-known/oauth-authorization-server
note: >-
  derive-oauth-scopes.py found no oauth2 securityScheme in any harvested OpenAPI — the REST APIs are bearer-API-key
  only. The OAuth surface exists solely to authorize the hosted MCP server, and is described by RFC 8414
  authorization-server metadata rather than by the specs. This artifact is built from that live metadata document,
  not derived from a spec and not searched from a docs scopes page (Sarj publishes none).
schemes:
  - name: MCP OAuth
    source: https://platform-api.sarj.ai/.well-known/oauth-authorization-server
    issuer: https://platform-api.sarj.ai
    applies_to: https://platform-api.sarj.ai/api/v1/mcp
    dynamic_client_registration: https://platform-api.sarj.ai/api/v1/oauth/register
    flows:
      - flow: authorizationCode
        authorizationUrl: https://platform-api.sarj.ai/api/v1/oauth/authorize
        tokenUrl: https://platform-api.sarj.ai/api/v1/oauth/token
        pkce: S256
        response_types: [code]
        response_modes: [query]
        token_endpoint_auth_methods: [none]
scopes:
  - scope: openid
    description: >-
      The only scope the authorization server advertises. Published verbatim in scopes_supported; the provider
      documents no scope reference page and no per-capability scopes.
    flows: [authorizationCode]
    sources:
      - https://platform-api.sarj.ai/.well-known/oauth-authorization-server
findings:
  - id: no-granular-scopes
    detail: >-
      scopes_supported is ["openid"] alone. An MCP client cannot request read-only access — the browser sign-in mints
      an account- and organization-scoped API key with the same authority as a dashboard-generated key, which the MCP
      Server documentation states explicitly. There is no least-privilege path for an agent.
  - id: public-clients-only
    detail: >-
      token_endpoint_auth_methods_supported is ["none"], so clients are public and security rests entirely on PKCE
      S256 plus redirect-URI validation. The developer OpenAPI carries an oauth_invalid_redirect_uri error payload,
      which is consistent with redirect-URI checking being the enforcement point.
x-evidence:
  - url: https://platform-api.sarj.ai/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json