generated: '2026-08-06'
method: probed
source: https://api.acrisure.com/.well-known/oauth-authorization-server
description: >-
  Acrisure publishes no OpenAPI, so this profile is not derived from securitySchemes. It is
  read directly from the RFC 8414 authorization-server metadata that api.acrisure.com
  serves anonymously, plus the observed 302 from /oauth/authorize. The single protected
  resource this covers is the hosted MCP server at https://api.acrisure.com/v1/mcp.
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
  api_key_in: []
  identity_provider: Microsoft Entra ID
  pkce_required_methods:
  - S256
schemes:
- name: AcrisureOAuth2
  type: oauth2
  source: https://api.acrisure.com/.well-known/oauth-authorization-server
  issuer: https://api.acrisure.com
  jwks_uri: https://login.microsoftonline.com/c2ec94c0-ebd0-4630-aef2-2dcf0eb68ebd/discovery/v2.0/keys
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.acrisure.com/oauth/authorize
    tokenUrl: https://api.acrisure.com/oauth/token
    refreshUrl: https://api.acrisure.com/oauth/token
    scopes:
      api://bc250bc0-7689-4f21-b164-72a6b57c273b/mcp_user: >-
        Application scope for the Acrisure MCP server. Description not published by
        Acrisure — the scope name is verbatim from scopes_supported.
      offline_access: Standard OIDC scope permitting refresh-token issuance.
  grant_types:
  - authorization_code
  - refresh_token
  response_types:
  - code
  response_modes:
  - query
  token_endpoint_auth_methods:
  - client_secret_post
  - client_secret_basic
  code_challenge_methods:
  - S256
protected_resources:
- url: https://api.acrisure.com/v1/mcp
  kind: MCPServer
  artifact: mcp/acrisure-mcp.yml
  observed_status: 403
notes:
- >-
  The authorization and token endpoints are Acrisure-branded proxies on api.acrisure.com;
  /oauth/authorize 302s to
  login.microsoftonline.com/c2ec94c0-ebd0-4630-aef2-2dcf0eb68ebd, so the actual
  authorization server is Microsoft Entra ID and the tenant is Acrisure's own.
- >-
  Client registration is not self-serve. There is no dynamic client registration endpoint
  in the metadata and no public sign-up for API credentials, so a client_id must be issued
  out of band by Acrisure.
- >-
  No OpenID Connect discovery document is served
  (/.well-known/openid-configuration returns 404 on api.acrisure.com), so this is OAuth 2.0
  authorization-server metadata only, not OIDC.
- >-
  No documentation page for authentication exists on any Acrisure host — this profile is
  built entirely from machine-readable discovery metadata, not from prose docs.
x-evidence:
  fetched: '2026-08-06'
  probes:
  - url: https://api.acrisure.com/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json
    file: well-known/acrisure-oauth-authorization-server.json
  - url: https://api.acrisure.com/oauth/authorize
    http_status: 302
    location: https://login.microsoftonline.com/c2ec94c0-ebd0-4630-aef2-2dcf0eb68ebd/oauth2/v2.0/authorize
  - url: https://api.acrisure.com/oauth/token
    http_status: 405
    note: Method Not Allowed on GET — the endpoint exists and accepts POST only.
  - url: https://api.acrisure.com/.well-known/openid-configuration
    http_status: 404