ARO · Operational

OAuth protected resource

OAuth protected resource is an Agent Readiness Optimization check in the Auth and trust group.

Version agent-readiness-2026-10

What is this benchmark?

OAuth protected resource is an Agent Readiness Optimization check in the Auth and trust group.

Why it matters

A protected-resource document describes which APIs require a token.

How SiteGlue evaluates it

HTTP request to a well-known or published URL. Spec: https://www.rfc-editor.org/rfc/rfc9728. Catalog agent-readiness-2026-10.

Passing criteria: The published signal for OAuth protected resource is present and readable.
Failing criteria: The scan requested the signal and it was missing, blocked, or malformed.
Not verified: The check was not selected, the probe did not run, or evidence was inconclusive. Not verified is never scored as 0.
Not applicable: Not applicable when the business has no corresponding surface (for example commerce protocols on a site with no cart).

Scoring weight: 1. Evidence: Public HTTP, HTML, or DNS evidence for OAuth protected resource. No private credentials.

Example results

Pass

Agents can read a valid OAuth protected resource signal on the public site.

Fail

OAuth protected resource is missing, blocked, or not machine-readable.

Recommended fixes

Publish the protected-resource metadata for the API this project actually protects.

Related benchmarks

Frequently asked questions

Does a missing optional check lower my ARO score?

Yes, if the check is applicable and failed. Not verified items are excluded.

No. ARO is a website audit. Optional live walks are Test With AI Agents.