Validate a phase 0 MCP connection | Bibleit API Reference

Issuer-side validation endpoint for the Bibleit MCP adapter. Requires a Bearer oa_ token bound to BIBLEIT_MCP_RESOURCE_URI with identity.read. Returns basic identity, client ID, granted scopes, expiry and audience. Rejects ordinary REST OAuth, personal and organization service tokens with 401; missing identity scope returns 403. Not a general token introspection or REST delegation endpoint. Disabled when no MCP resource is configured. All responses are no-store.

Response headers:

Cache-Control (200): no-store.
Referrer-Policy (200): no-referrer.
Pragma (200): no-cache. Requires current actor mcp.get permission; revocation returns 403 access_denied. Returns only MCP-specific actor permissions for adapter discovery/tool gates; these never grant domain access or replace OAuth scopes.

Authentication

AuthorizationBearer

Registered public-client OAuth for personal-account resources only. Exact registered HTTPS or fixed-port literal loopback redirect; S256 required; explicit consent. No organization/presentation authority. identity.read is required for /me and account metadata. Scope intersection with current user authority; no empty-scope inheritance.

Response headers

Cache-Control"no-store"Optional

Referrer-Policy"no-referrer"Optional

Pragma"no-cache"Optional

Response

Validated basic identity and MCP grant metadata; checked freshly against the configured audience.

idstringformat: "uuid"

display_namestring

handlestring or null

personal_account_idstringformat: "uuid"

client_idstring

scopeslist of strings

expires_atinteger

resourcestringformat: "uri"

permissionslist of enums

Fresh actor MCP entitlement, separate from consented OAuth scopes. Missing mcp.get denies the request; list/call are enforced by the adapter.

Allowed values: