# auth.md — Miguel Betancourt Atelier Agent Authentication & Registration

## Overview
This document (`auth.md`) defines the authentication, discovery, and automated registration protocols for AI Agents, autonomous LLM assistants, and collector agents interacting with the Miguel Betancourt Atelier API and WebMCP services.

- **Origin / Issuer**: `https://www.miguelbetancourt.com`
- **OpenAPI 3.1 Spec**: `https://www.miguelbetancourt.com/openapi.json`
- **OAuth Protected Resource Metadata (RFC 9728)**: `https://www.miguelbetancourt.com/.well-known/oauth-protected-resource`
- **OAuth Authorization Server Metadata (RFC 8414)**: `https://www.miguelbetancourt.com/.well-known/oauth-authorization-server`
- **OpenID Connect Configuration**: `https://www.miguelbetancourt.com/.well-known/openid-configuration`
- **JWKS Endpoint**: `https://www.miguelbetancourt.com/.well-known/jwks.json`
- **API Catalog (RFC 9727)**: `https://www.miguelbetancourt.com/.well-known/api-catalog`
- **MCP Server Card (SEP-1649)**: `https://www.miguelbetancourt.com/.well-known/mcp/server-card.json`
- **Agent Skills Index**: `https://www.miguelbetancourt.com/.well-known/agent-skills/index.json`
- **LLMs Full Context**: `https://www.miguelbetancourt.com/llms.txt`

---

## Agent Registration & Provisioning

### Audience
AI agents acting on behalf of art collectors, gallery curators, auction houses, and cultural institutions.

<a id="anonymous-access"></a>
### 1. Anonymous Access (Default Read-Only)
No pre-registration required for public artwork discovery and artist biography queries:
- **Endpoints**:
  - `GET /wp-json/miguelb-ai/v1/artworks` — Search paintings (query, technique, price, availability).
  - `GET /wp-json/miguelb-ai/v1/artworks/{id}` — Artwork details, dimensions, and high-res images.
  - `GET /wp-json/miguelb-ai/v1/trajectory` — Complete historical timeline (1974–Present) and biennials.
  - `GET /wp-json/miguelb-ai/v1/health` — Service health status.
- **Credential Types**: None or `Bearer anonymous`.
- **Rate Limit**: 60 requests per minute per IP.

<a id="agent-registration"></a>
### 2. Collector Inquiry & Action Submission (Identified Access)
For submitting acquisition requests and inquiries (`POST /wp-json/miguelb-ai/v1/inquiry` or `POST /wp-json/miguelb-ai/v1/collector-inquiry`):
- **Identity Types Supported**: `verified_email`, `urn:ietf:params:oauth:token-type:id-jag`, `agent_did`.
- **Supported Credentials**: `Bearer <access_token>`, `X-API-Key: <key>`, or structured JSON payload with verified collector contact.
- **Payload Example**:
```json
{
  "name": "Collector or Agent Name",
  "email": "collector@example.com",
  "phone": "+1-555-0199",
  "artwork_id": 3379,
  "artwork_title": "Palimpsesto 0°",
  "message": "Inquiry regarding acquisition, international shipping, and certificate of authenticity.",
  "source": "AI Agent Assistant"
}
```

---

## OAuth 2.0 & Token Exchange

- **Authorization Endpoint**: `https://www.miguelbetancourt.com/oauth/authorize`
- **Token Endpoint**: `https://www.miguelbetancourt.com/oauth/token`
- **Revocation Endpoint**: `https://www.miguelbetancourt.com/oauth/revoke`
- **Grant Types**: `authorization_code`, `client_credentials`, `urn:ietf:params:oauth:grant-type:token-exchange`, `refresh_token`
- **PKCE Code Challenge**: `S256`

### Supported Scopes
- `artworks:read` — Read painting catalog and exhibition records.
- `inquiry:create` — Submit purchase inquiries and consultation requests.
- `trajectory:read` — Access artist timeline, international exhibitions, and museum collections.

---

## Studio Contact & Support
For custom curation partnerships or direct studio API key provisioning:
- **Email**: `info@miguelbetancourt.com` / `miguel@miguelbetancourt.com`
- **Studio**: Cumbayá / Quito, Ecuador
- **Web**: `https://www.miguelbetancourt.com/contacto/`