diff --git a/api/openapi.json b/api/openapi.json
index 168e728..0ddfe14 100644
--- a/api/openapi.json
+++ b/api/openapi.json
@@ -6060,6 +6060,32 @@
         }
       }
     },
+    "/.well-known/oauth-protected-resource/api/graphql": {
+      "get": {
+        "operationId": "get-.well-known-oauth-protected-resource-api-graphql",
+        "summary": "Canonical RFC 9728 protected resource metadata for GraphQL",
+        "tags": [
+          "Api"
+        ],
+        "responses": {
+          "200": {
+            "description": "Response 200"
+          }
+        }
+      },
+      "options": {
+        "operationId": "options-.well-known-oauth-protected-resource-api-graphql",
+        "summary": "CORS preflight for GraphQL protected resource metadata",
+        "tags": [
+          "Api"
+        ],
+        "responses": {
+          "204": {
+            "description": "Response 204"
+          }
+        }
+      }
+    },
     "/.well-known/oauth-protected-resource/api/mcp": {
       "get": {
         "operationId": "get-.well-known-oauth-protected-resource-api-mcp",
diff --git a/internal/cmd/apicmd/api_paths_gen.go b/internal/cmd/apicmd/api_paths_gen.go
index e7304ae..33b215e 100644
--- a/internal/cmd/apicmd/api_paths_gen.go
+++ b/internal/cmd/apicmd/api_paths_gen.go
@@ -6,6 +6,7 @@ var generatedAPIPaths = []string{
 	"/.well-known/oauth-authorization-server/api/auth",
 	"/.well-known/oauth-authorization-server/api/mcp",
 	"/.well-known/oauth-protected-resource",
+	"/.well-known/oauth-protected-resource/api/graphql",
 	"/.well-known/oauth-protected-resource/api/mcp",
 	"/.well-known/openid-configuration",
 	"/.well-known/openid-configuration/api/auth",