# auth.md — Anatomy IT agent registration

This file tells an AI agent how to get credentials for the one write
capability this site exposes to agents: submitting a contact/lead request on
a user's behalf. Reading content on www.anatomyit.com needs no credentials at
all — see https://www.anatomyit.com/.well-known/agent-skills/index.json.

## Who this is for

An AI agent acting on behalf of a real person who wants Anatomy IT to follow
up with them, and needs to call the lead-submission API without a human
present to solve the Turnstile challenge the public form uses.

## Registration

Registration is reviewed, not automatic. Submit a request the same way any
inquiry reaches Anatomy IT — https://www.anatomyit.com/contact — identifying
yourself as an agent operator requesting API access, with a verified contact
email. A person reviews each request before any credential is issued; there
is no self-serve signup.

Once approved, you receive a `client_id` and `client_secret` for the OAuth
2.0 Client Credentials grant.

## OAuth metadata

- Authorization Server metadata (RFC 8414):
  https://www.anatomyit.com/.well-known/oauth-authorization-server
- Protected Resource metadata (RFC 9728):
  https://www.anatomyit.com/.well-known/oauth-protected-resource/api/lead/contact

```json
{
  "agent_auth": {
    "skill": "leads:write",
    "register_uri": "https://www.anatomyit.com/contact",
    "methods": [
      {
        "type": "verified_email",
        "identity_assertion": {
          "assertion_types_supported": ["verified_email"],
          "credential_types_supported": ["client_secret_post"],
          "claim_uri": "https://www.anatomyit.com/auth.md"
        }
      }
    ]
  }
}
```

## Using a token

`POST https://www.anatomyit.com/api/agent/token` with
`grant_type=client_credentials`, your `client_id` and `client_secret` as
`application/x-www-form-urlencoded` fields. The response is a Bearer token
good for one hour, scoped to `leads:write`.

Call `POST https://www.anatomyit.com/api/lead/contact` as usual (see
https://www.anatomyit.com/.well-known/api-catalog), with
`Authorization: Bearer <token>` in place of the browser Turnstile challenge.
Every other field on that endpoint is validated exactly as it is for a human
visitor.

## Publish only what works

Every capability named in this file is live today. Nothing here is
aspirational.