# AgentAccess auth.md — AI Agent Authentication & Registration

> Authoritative Agent Experience (AX) discovery and credential provisioning document for autonomous agents interacting with AgentAccess and Danish data infrastructure.

## 1. Agent Audience

This service is designed for autonomous software agents, framework runners (such as Claude Desktop, Cursor, LangChain, LlamaIndex, and OpenAI Swarm), and automated crawlers querying Danish public registers, APIs, MCP servers, and semantic knowledge graphs.

Agents have first-class consumer rights on AgentAccess. All public directory endpoints, SPARQL query endpoints, RDF serializers, and Markdown negations are openly accessible with zero upfront human approval.

---

## 2. Machine Discovery Endpoints

AgentAccess advertises two-hop discovery following standard OAuth specifications, Auth.md, and the A2A Protocol:

- **OAuth 2.0 Protected Resource Metadata (RFC 9728)**:
  [`https://agentaccess.dk/.well-known/oauth-protected-resource`](https://agentaccess.dk/.well-known/oauth-protected-resource)
- **OAuth 2.0 Authorization Server Metadata (RFC 8414)**:
  [`https://agentaccess.dk/.well-known/oauth-authorization-server`](https://agentaccess.dk/.well-known/oauth-authorization-server)
- **A2A Protocol Agent Card (A2A Specification v1.0)**:
  [`https://agentaccess.dk/.well-known/agent-card.json`](https://agentaccess.dk/.well-known/agent-card.json)
- **RFC 9727 API Catalog**:
  [`https://agentaccess.dk/.well-known/api-catalog`](https://agentaccess.dk/.well-known/api-catalog)
- **LLMs Text Index**:
  [`https://agentaccess.dk/llms.txt`](https://agentaccess.dk/llms.txt)

---

## 3. Supported Registration & Authentication Methods

AgentAccess implements the following authentication flows for autonomous agents:

### Method A: Anonymous Read Access (Default)
- **Identity Type**: `anonymous`
- **Credential Types**: `bearer_token`, `api_key`
- **Provisioning**: Immediate / Zero-barrier.
- **Access Granted**:
  - `GET /api/tools` — Complete directory query
  - `GET /api/sparql` / `POST /api/sparql` — W3C SPARQL 1.1 query engine
  - `GET /api/rdf` — Turtle (.ttl) RDF serialization
  - `GET /llms.txt` & `GET /llms-full.txt` — Complete context datasets
  - All Markdown representations (`*.md` and `Accept: text/markdown`)
- **Claim URI**: [`https://agentaccess.dk/api/agent/claim`](https://agentaccess.dk/api/agent/claim)

### Method B: Verified Email Registration
- **Identity Type**: `identity_assertion` (`verified_email`)
- **Credential Types**: `bearer_token`
- **Use Case**: Proposing new Danish data interfaces, submitting tool entries via `/api/submissions`, or requesting elevated rate limits.
- **Registration URI**: [`https://agentaccess.dk/api/agent/register`](https://agentaccess.dk/api/agent/register)
- **Claim URI**: [`https://agentaccess.dk/api/agent/claim`](https://agentaccess.dk/api/agent/claim)

### Method C: Identity Assertion (ID-JAG)
- **Identity Type**: `identity_assertion`
- **Assertion Type**: `urn:ietf:params:oauth:token-type:id-jag`
- **Credential Types**: `bearer_token`
- **Revocation URI**: [`https://agentaccess.dk/api/agent/revoke`](https://agentaccess.dk/api/agent/revoke)
- **Events Supported**: `urn:ietf:params:oauth:event:revocation`

---

## 4. Credential Usage

When an agent token is issued or acquired:

```http
GET /api/tools HTTP/1.1
Host: agentaccess.dk
Authorization: Bearer <agent_token>
Accept: application/json
```

Bearer tokens must be passed in the standard HTTP `Authorization` header. Anonymous requests without an Authorization header are treated with the default public quota.

---

## 5. Danish Citizen Authentication & MitID Notice (HITL)

> [!IMPORTANT]
> **Zero Autonomous MitID Automation**: In compliance with Danish security infrastructure and the AgentAccess AX Charter, autonomous agents **cannot** bypass MitID multi-factor app approvals, SMS OTPs, or CAPTCHAs. Any Danish system indexed in this catalog requiring MitID authentication requires a **Human-in-the-Loop (HITL)** delegation handoff.