# auth.md — AlbaMed

The public API of https://albamed.org is **anonymous access**: no registration, no credentials, no tokens.
If you are following the standard `discover → register → claim → exchange → use` recipe, you
stop at step 2 with `method = anonymous` and call the endpoint directly.

## Step 1 — Discover

| Document | Status |
| --- | --- |
| `/.well-known/oauth-protected-resource` (RFC 9728) | **Not published.** Nothing here is an OAuth protected resource; no endpoint requires an access token. |
| `/.well-known/oauth-authorization-server` (RFC 8414) | **Not published.** This domain issues no tokens. |
| `/.well-known/openid-configuration` | **Not published.** AlbaMed is an OAuth *client* of Google for staff sign-in, not an OpenID provider. |

Publishing any of the three would advertise an `issuer`, an `authorization_endpoint`, a
`token_endpoint` and a `jwks_uri` that do not exist, and every one of those URLs would
answer 404. Fetch these instead:

| Document | What it gives you |
| --- | --- |
| [`/.well-known/api-catalog`](https://albamed.org/.well-known/api-catalog) | RFC 9727 catalog of every public API. |
| [`/api/openapi.json`](https://albamed.org/api/openapi.json) | OpenAPI 3.1, with `security: []` at the document root — the machine-readable "no credentials required". |
| [`/docs/api`](https://albamed.org/docs/api) | The same, for a human. |
| [`/.well-known/agents.json`](https://albamed.org/.well-known/agents.json) | Agent index. `agents: []` — no A2A or MCP endpoint is published here. |

The `Link` header on every public page carries the first three, so one request to `https://albamed.org/` is
enough to find them.

## Step 2 — Pick a method

`anonymous`.

- `identity_assertion` — not applicable: there is no registration endpoint and no claim ceremony.
- `service_auth` — not applicable: there are no client credentials to issue or present.

## Steps 3 to 6 — Register, claim, exchange, use

Steps 3 through 5 do not apply. Go straight to the call, with no `Authorization` header:

| Endpoint | What it returns | Auth |
| --- | --- | --- |
| `GET /api/branding` | Shared brand and social metadata | anonymous |
| `GET /api/legal/{kind}` | Published Privacy Policy or Terms of Service as JSON | anonymous |
| `POST /contact` | Send a contact request | anonymous |
| `GET /healthz` | Liveness probe | anonymous |

`POST /contact` is the only one that writes anything; it is protected against cross-site
submission, not against you: read the token from the `<meta name="csrf-token">` tag on the
homepage and send it back in the `X-CSRFToken` header with that request's session cookie.

## Revocation

Nothing to revoke. No credential is issued, so there is no credential layer (RFC 7009) and no
registration layer (RFC 8935) to unsubscribe from. Access can be withdrawn only at the network
level, and the terms at https://albamed.org/terms still govern use.

## Rate limits

None beyond ordinary abuse protection. Responses are cacheable — `Cache-Control` says for how
long — and caching them is preferred to re-fetching.

## What is not available to automated clients

The AlbaMed platforms themselves — billing, clinical and audit — require a user account,
are not reachable from this API, and are not documented here. No patient data, no protected
health information and no tenant records are exposed by anything on this domain.

## Content usage

[`/robots.txt`](https://albamed.org/robots.txt) declares `search=yes, ai-input=yes, ai-train=no`.

## Contact

Questions about this API: [https://albamed.org/#contact](https://albamed.org/#contact).