# auth.md

## Audience
AI agents discovering أمان للتكييفات (Aman Air Conditioning) public content and booking flows.

## Public access
- HTML pages, sitemaps, and discovery documents are publicly readable.
- No OAuth access token is required to browse services, cities, blog posts, or docs.
- Preferred discovery entrypoints:
  - https://aman-ac.com/.well-known/ai-catalog.json
  - https://aman-ac.com/.well-known/api-catalog
  - https://aman-ac.com/openapi.json
  - https://aman-ac.com/.well-known/mcp/server-card.json
  - https://aman-ac.com/.well-known/ucp

## Agent registration (anonymous)
- Method: anonymous
- `register_uri`: https://aman-ac.com/booking
- Identity endpoint: `POST https://aman-ac.com/agent/identity` with `{ "type": "anonymous" }`
- Claim endpoint / `claim_uri`: `POST https://aman-ac.com/agent/identity/claim`
- Events endpoint: `POST https://aman-ac.com/agent/event/notify`
- Machine booking create: `POST https://aman-ac.com/api/bookings` (JSON body documented in OpenAPI)
- Credentials: none (guest name + phone on the booking form)
- `identity_types_supported`: anonymous
- `anonymous.credential_types_supported`: none

## agent_auth

```json
{
  "skill": "https://aman-ac.com/auth.md",
  "register_uri": "https://aman-ac.com/booking",
  "identity_endpoint": "https://aman-ac.com/agent/identity",
  "claim_endpoint": "https://aman-ac.com/agent/identity/claim",
  "events_endpoint": "https://aman-ac.com/agent/event/notify",
  "revocation_uri": "https://aman-ac.com/api/health",
  "identity_types_supported": [
    "anonymous"
  ],
  "anonymous": {
    "credential_types_supported": [
      "none"
    ],
    "claim_uri": "https://aman-ac.com/agent/identity/claim"
  },
  "events_supported": [
    "https://schemas.workos.com/events/agent/auth/identity/assertion/revoked"
  ]
}
```

## OAuth / Auth.md metadata (machine-readable)
- Protected resource metadata (PRM): https://aman-ac.com/.well-known/oauth-protected-resource
- Authorization server metadata: https://aman-ac.com/.well-known/oauth-authorization-server
- Both documents include an `agent_auth` block with `register_uri`, `identity_types_supported`, anonymous `claim_uri`, `revocation_uri`, and event endpoints.
- Issuer / authorization server origin: https://aman-ac.com

## Human admin only
- A private operator console exists for human staff with NextAuth credentials (path is not published).
- Agents must not attempt admin authentication.