{"summary":"Call /v1/* with an Entra (OIDC) bearer token. Pick the flow for your caller type below — an agent/service authenticates headlessly via client-credentials (a plain HTTPS POST), never a CLI.","issuer":"https://login.microsoftonline.com/120aeae9-286f-438a-bbf3-de3ab96fcf5d/v2.0","audience":"b2807fb8-2c07-4b9b-9c02-e3c912a60103","token_endpoint":"https://login.microsoftonline.com/120aeae9-286f-438a-bbf3-de3ab96fcf5d/oauth2/v2.0/token","scope":"api://b2807fb8-2c07-4b9b-9c02-e3c912a60103/access_as_user","scope_rules":{"use_the_fully_qualified_scope":"api://b2807fb8-2c07-4b9b-9c02-e3c912a60103/access_as_user","why":"Entra derives a token's audience from the 'api://<client-id>/' prefix and implements no resource indicators (RFC 8707). Requesting the bare 'access_as_user' yields a token for the wrong audience, which this API then rejects — a failure that looks like a broken server.","dot_default":{"value":"api://b2807fb8-2c07-4b9b-9c02-e3c912a60103/.default","use_it_for":"client-credentials (an autonomous agent or service), and the Azure CLI / PowerShell, which do not take an arbitrary delegated scope.","do_not":"Do not combine it with the qualified scope above. Entra refuses: AADSTS70011 — '.default scope can't be combined with resource-specific scopes'. This is why '.default' is not listed in scopes_supported."}},"authorization_server_metadata":{"url":"https://login.microsoftonline.com/120aeae9-286f-438a-bbf3-de3ab96fcf5d/v2.0/.well-known/openid-configuration","note":"Entra publishes OpenID Connect discovery only. RFC 8414 ('/.well-known/oauth-authorization-server') is not served — a client that implements only RFC 8414 cannot bootstrap here and needs an OpenID-Connect-discovery fallback."},"how_to_get_a_token":{"agent_or_service_headless":{"flow":"OAuth2 client_credentials — a plain HTTPS POST to the token endpoint","token_endpoint":"https://login.microsoftonline.com/120aeae9-286f-438a-bbf3-de3ab96fcf5d/oauth2/v2.0/token","body":"grant_type=client_credentials&client_id=<your-app-id>&scope=api://b2807fb8-2c07-4b9b-9c02-e3c912a60103/.default&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&client_assertion=<signed-jwt>   (federated/cert; or client_secret=<secret>)","requires":"a registered automation principal (service principal) granted access to this API. Prefer a federated credential (no stored secret)."},"human_delegated":{"browser":"Open the Console — MSAL signs you in (silent on a joined device).","azure_cli":"az account get-access-token --scope api://b2807fb8-2c07-4b9b-9c02-e3c912a60103/.default --query accessToken -o tsv","azure_powershell":"(Get-AzAccessToken -ResourceUrl \"api://b2807fb8-2c07-4b9b-9c02-e3c912a60103\").Token"},"agent_on_behalf_of_a_human":"OAuth2 on-behalf-of (RFC 8693) — exchange the user's token for one with the user as subject and the agent as `act`."},"use_it":"Send 'Authorization: Bearer <token>' on every /v1/* request.","capabilities":[{"capability":"read","description":"browse/read a tenant's models, artifacts, lineage, curated context"},{"capability":"ingest","description":"load bundles / reconcile into a working line"},{"capability":"annotate","description":"add or edit annotations"},{"capability":"curate","description":"set/clear curated context (definition/usage/impact); rename"},{"capability":"version.manage","description":"create snapshots; delete (incl. cascade); manage the working line"},{"capability":"access.manage","description":"grant/revoke capabilities on a tenant"},{"capability":"principal.manage","description":"create/rotate/revoke automation principals for a tenant"},{"capability":"admin","description":"all capabilities on a tenant"}],"discovery":{"protected_resource_metadata":"https://api.dev.datadictionary.highspring-labs.com/.well-known/oauth-protected-resource"},"api_docs":{"swagger":"https://api.dev.datadictionary.highspring-labs.com/docs","redoc":"https://api.dev.datadictionary.highspring-labs.com/redoc","openapi_json":"https://api.dev.datadictionary.highspring-labs.com/openapi.json","openapi_yaml":"https://api.dev.datadictionary.highspring-labs.com/openapi.yaml"},"health":{"liveness":"https://api.dev.datadictionary.highspring-labs.com/healthz","readiness":"https://api.dev.datadictionary.highspring-labs.com/readyz"}}