> ## Documentation Index > Fetch the complete documentation index at: https://ai.easyaf.dev/llms.txt > Use this file to discover all available pages before exploring further. # ProtectedResourceMetadataOptions > What an API publishes about how to sign in to it: the RFC 8414 authorization servers that issue its tokens, the scopes a client should ask for, and which rou... ## Definition **Assembly:** Microsoft.OData.Mcp.AspNetCore.dll **Namespace:** Microsoft.OData.Mcp.AspNetCore.Authentication **Inheritance:** System.Object ## Syntax ```csharp theme={null} Microsoft.OData.Mcp.AspNetCore.Authentication.ProtectedResourceMetadataOptions ``` ## Summary What an API publishes about how to sign in to it: the RFC 8414 authorization servers that issue its tokens, the scopes a client should ask for, and which route bases the published document covers. ## Remarks Nothing here describes how the API validates a token. That stays with whatever authentication handler the app already registered; this type only describes the API to a client that has not signed in yet. The default route base is the application root, which is the usual shape of an API that is not sharing a host with MVC. ## Examples ```csharp theme={null} builder.Services.AddProtectedResourceMetadata(options => { options.AuthorizationServers.Add(new Uri("https://login.microsoftonline.com/contoso.com/v2.0")); options.ScopesSupported.Add("api://contoso-odata/Data.Read"); options.ResourceName = "Contoso API"; }); ``` ## Constructors ### .ctor #### Syntax ```csharp theme={null} public ProtectedResourceMetadataOptions() ``` ### .ctor Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public Object() ``` ## Properties ### AnnotateChallenges Gets or sets a value indicating whether a `401` under a covered route base has its `WWW-Authenticate` challenge rewritten to carry `resource_metadata`. #### Syntax ```csharp theme={null} public bool AnnotateChallenges { get; set; } ``` #### Property Value Type: `bool` Defaults to [`true`](https://learn.microsoft.com/dotnet/csharp/language-reference/builtin-types/bool). #### Remarks Turn this off only when the app already emits an RFC 9728 hint of its own. A client that never sees `resource_metadata` still finds the document through the two well-known URLs, but it spends an extra request doing so. ### AuthorizationServers Gets the RFC 8414 issuer URLs of the authorization servers that issue tokens for this API, in the order a client should try them. #### Syntax ```csharp theme={null} public System.Collections.Generic.List AuthorizationServers { get; } ``` #### Property Value Type: `System.Collections.Generic.List` At least one entry is required. Each must be absolute and `https`; `http` is accepted only for loopback hosts so a test or a local identity provider still works. #### Examples ```csharp theme={null} options.AuthorizationServers.Add(new Uri("https://login.microsoftonline.com/contoso.com/v2.0")); ``` ### Prefixes Gets the route bases the published documents cover, in the same form Endpoint Routing and Minimal APIs accept. #### Syntax ```csharp theme={null} public System.Collections.Generic.List Prefixes { get; } ``` #### Property Value Type: `System.Collections.Generic.List` Empty by default, which means the application root only. A non-empty list replaces that default. #### Examples ```csharp theme={null} options.Prefixes.Add(""); options.Prefixes.Add("odata"); options.Prefixes.Add("api/v1"); ``` #### Remarks An empty string and `/` are the application root, matching `MapGroup("")` and `AddRouteComponents(string.Empty, model)`. `odata` and `/odata/` both mean the `/odata` base. Nested bases such as `api/v1` are valid. A whitespace-only entry is rejected by [ProtectedResourceMetadataOptions.Validate](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataOptions.md#validate): it is not a route base. ### ResourceDocumentation Gets or sets the URL of a page a developer can read to learn how to call this API. #### Syntax ```csharp theme={null} public System.Uri ResourceDocumentation { get; set; } ``` #### Property Value Type: `System.Uri?` ### ResourceName Gets or sets the human-readable name of this API, shown to a user during consent. #### Syntax ```csharp theme={null} public string ResourceName { get; set; } ``` #### Property Value Type: `string?` ### ScopesSupported Gets the scope values a client should request to call this API. #### Syntax ```csharp theme={null} public System.Collections.Generic.List ScopesSupported { get; } ``` #### Property Value Type: `System.Collections.Generic.List` Empty by default, in which case a client falls back to whatever scopes its operator configured. ## Methods ### Equals Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual bool Equals(object obj) ``` #### Parameters | Name | Type | Description | | - | - | - | | `obj` | `object?` | - | #### Returns Type: `bool` ### Equals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool Equals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### GetHashCode Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual int GetHashCode() ``` #### Returns Type: `int` ### GetType Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public System.Type GetType() ``` #### Returns Type: `System.Type` ### MemberwiseClone Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} protected internal object MemberwiseClone() ``` #### Returns Type: `object` ### ReferenceEquals Inherited > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public static bool ReferenceEquals(object objA, object objB) ``` #### Parameters | Name | Type | Description | | - | - | - | | `objA` | `object?` | - | | `objB` | `object?` | - | #### Returns Type: `bool` ### ToString Inherited Virtual > [!NOTE] > > Inherited from `object` #### Syntax ```csharp theme={null} public virtual string ToString() ``` #### Returns Type: `string?` ### Validate Fails the host when the published document would be unusable. #### Syntax ```csharp theme={null} public void Validate() ``` #### Exceptions | Exception | Description | | - | - | | `InvalidOperationException` | Thrown when [ProtectedResourceMetadataOptions.AuthorizationServers](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataOptions.md#authorizationservers) is empty, carries a [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null), a | | non-absolute, or a non-`https` non-loopback entry; or when [ProtectedResourceMetadataOptions.Prefixes](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataOptions.md#prefixes) carries a | | | [`null`](https://learn.microsoft.com/dotnet/csharp/language-reference/keywords/null) or whitespace-only entry. | | #### Examples ```csharp theme={null} var options = new ProtectedResourceMetadataOptions(); options.AuthorizationServers.Add(new Uri("https://login.example.com/tenant")); options.Validate(); ``` #### Remarks Called by [ProtectedResourceMetadataStartupFilter](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataStartupFilter.md) before the pipeline is built, so a misconfigured API refuses to start rather than serving a document that sends every client to an authorization server that does not exist. An empty string and `/` in [ProtectedResourceMetadataOptions.Prefixes](https://ai.easyaf.dev/odata-mcp/api-reference/Microsoft/OData/Mcp/AspNetCore/Authentication/ProtectedResourceMetadataOptions.md#prefixes) are the application root and pass. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.