# infiSet Authentication & Machine Agent Protocol (auth.md)

> Version: 1.0.0
> Specification: https://workos.com/auth-md / https://github.com/workos/auth.md
> Issuer: https://infiset.com
> Contact: connect@infiset.com

---

## 1. Overview for Autonomous AI Agents & Developers

infiSet provides programmatic endpoints for AI agents, developer tooling, and automated client systems to discover capabilities, assess architectures, and submit technical project briefs.

---

## 2. Authentication Endpoints

- **OAuth 2.0 / OIDC Issuer**: `https://infiset.com`
- **Authorization Server Discovery (RFC 8414)**: `https://infiset.com/.well-known/oauth-authorization-server`
- **OpenID Connect Discovery**: `https://infiset.com/.well-known/openid-configuration`
- **Protected Resource Metadata (RFC 9728)**: `https://infiset.com/.well-known/oauth-protected-resource`
- **Token Endpoint**: `https://infiset.com/api/auth/token`
- **Agent Dynamic Registration**: `https://infiset.com/api/auth/agent/register`

---

## 3. Supported Scopes

| Scope | Description | Access Level |
|---|---|---|
| `agent:read` | Read-only access to public capabilities, architecture invariants, and pricing tiers. | Public / Autonomous Agent |
| `agent:discovery` | Interactive querying of engineering disciplines, stacks, and delivery frameworks. | Public / Autonomous Agent |
| `agent:intake` | Programmatic submission of project briefs and intake requests to engineering desk. | Verified Agent / Bearer |
| `openid` | OpenID standard identity verification for human delegates and developers. | Authenticated |

---

## 4. Public Unauthenticated Endpoints (Rate-Limited)

Agents can query the following public endpoints without pre-registered credentials:
- **API Health**: `GET https://infiset.com/api/health`
- **API Catalog (RFC 9727)**: `GET https://infiset.com/.well-known/api-catalog`
- **OpenAPI 3.1 Spec**: `GET https://infiset.com/api/openapi.json`
- **LLMs Site Map**: `GET https://infiset.com/llms.txt`
- **MCP Server Card (SEP-1649)**: `GET https://infiset.com/.well-known/mcp/server-card.json`
- **A2A Agent Card**: `GET https://infiset.com/.well-known/agent-card.json`
- **Agent Skills Index**: `GET https://infiset.com/.well-known/agent-skills/index.json`
- **ARD Capability Catalog**: `GET https://infiset.com/.well-known/ai-catalog.json`
- **Intake Brief Submission**: `POST https://infiset.com/api/intake` (JSON payload)

---

## 5. Bearer Token Authorization

When invoking protected or high-rate tier operations, include your token in the standard HTTP header:

```http
Authorization: Bearer <your_agent_or_api_token>
Content-Type: application/json
```

---

## 6. Dynamic Agent Registration Flow

Autonomous agents desiring persistent credentials or webhook notifications can register via:

```http
POST /api/auth/agent/register HTTP/1.1
Host: infiset.com
Content-Type: application/json

{
  "client_name": "MyOrg-Scouting-Agent",
  "client_uri": "https://myorg.com/agent",
  "grant_types": ["client_credentials"],
  "response_types": ["token"],
  "scope": "agent:read agent:intake agent:discovery"
}
```

---

## 7. Security & Compliance Invariants

- All traffic is strictly TLS 1.3 encrypted and proxied via Cloudflare edge.
- Autonomous agent write operations are restricted to canonical outbox queues and validated schemas.
- For emergency token revocations or security disclosures: `security.txt` at `https://infiset.com/.well-known/security.txt` or email `connect@infiset.com`.