Under review and known gaps

This page exists so partners are not surprised. Honesty over polish.

Endpoints under review

• POST /v1/oauth/code, POST /v1/oauth/token, POST /v1/oauth/register — five commits in the last sixty days (MOVMO-333, 334, 335, 336). Signatures are stabilizing but Dynamic Client Registration session tracking and RFC 8707 resource-parameter enforcement are recent additions. The partner surface uses /v1/oauth/token only; /code is internal to auth.e2e.movmo.io and /register is reserved for autonomous Model Context Protocol (MCP) agents. Safe to integrate today; revisit after the related work lands in production.
• DELETE /v1/users/{userid} — Postgres-only delete. Does not purge Cognito, bookings, passengers, or payment methods. Out of the public surface until MOVMO-331 defines full user-deletion semantics.

MCP tool test coverage

The partner-facing MCP tool wrappers ship without unit tests. Their underlying REST endpoints are tested and gated at 85% coverage; the wrapper layer is not. Only REST signatures are protected by regression tests today.

Scope enforcement, previously listed here as a gap, shipped: partner tokens are now narrowed to their consented scopes and out-of-scope calls return 403 insufficient_scope. See Scopes and user consent.