RFC 9728 metadata format that an OAuth 2.0 client or authorization server can use to obtain the information needed to interact with an OAuth 2.0 protected resource.
You can configure whether to expose the protected resource metadata:
A GET endpoint is exposed in /.well-known/oauth-protected-resource. The API to control the metadata is:
api:security.oauth2.metadata.ProtectedResourceMetadataProvider[]
You can create a bean replacement for it if the default implementation does not fit your needs.
The same provider is used for the WWW-Authenticate Bearer challenge: if it returns non-empty scopes_supported values for the current request or path-specific metadata, those scopes are emitted as the challenge scope parameter.