# Comprehensive Behavior Solutions auth.md

## Overview

Welcome to the automated agent registration and authentication interface for **Comprehensive Behavior Solutions**.

This document outlines how autonomous AI agents, multi-agent frameworks, and client tools discover, register, and authenticate to access our clinical APIs, Model Context Protocol (MCP) server, and consultation inquiry workflows.

## Discovery & Standards Compliance

Comprehensive Behavior Solutions advertises standard authorization metadata:

- **OAuth Protected Resource Metadata (RFC 9728)**: [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource)
- **OAuth Authorization Server Metadata (RFC 8414)**: [/.well-known/oauth-authorization-server](/.well-known/oauth-authorization-server)
- **OpenID Connect Discovery**: [/.well-known/openid-configuration](/.well-known/openid-configuration)
- **API Catalog (RFC 9727)**: [/.well-known/api-catalog](/.well-known/api-catalog)
- **Model Context Protocol (MCP)**: [/.well-known/mcp/server-card.json](/.well-known/mcp/server-card.json)
- **Agent-to-Agent Protocol (A2A)**: [/.well-known/agent-card.json](/.well-known/agent-card.json)

## Audience & Scopes

Autonomous agents acting on behalf of parents, healthcare navigators, pediatricians, or insurance care managers may access public and authorized resources using the following scopes:

- `read:services`: Query ABA therapy service definitions, age groups, clinical approaches, and provider bios.
- `submit:inquiry`: Submit patient intake or consultation requests through `/api/contact` or MCP tools.
- `mcp:access`: Establish a Streamable HTTP or SSE session with the MCP server at `/api/mcp`.

## Agent Registration (`agent_auth`)

Agents can obtain credentials via automated registration at `/api/agent/register`:

### 1. Anonymous Ephemeral Tokens
- **Identity Type**: `anonymous`
- **Credential Type**: `ephemeral_bearer`
- **Claim URI**: `https://comprehensivebehaviorsolutions.com/api/agent/claim`
- **Use Case**: Read-only queries, insurance verification lookups, and initial consultation form submission.
- **Header**: `Authorization: Bearer <token>`

### 2. Verified Identity Assertions (ID-JAG & Verified Email)
- **Identity Type**: `identity_assertion`
- **Assertion Types**: `verified_email`, `urn:ietf:params:oauth:token-type:id-jag`
- **Credential Type**: `bearer_token`
- **Revocation URI**: `https://comprehensivebehaviorsolutions.com/oauth/revoke`
- **Use Case**: Healthcare coordination agents and verified institutional referrers.

## Public Resources (No Auth Required)

Public directory endpoints are accessible without authentication credentials:

- Information summary: [/llms.txt](/llms.txt) and [/llms-full.txt](/llms-full.txt)
- Public OpenAPI spec: [/openapi.json](/openapi.json)
- Service catalog: [/services](/services)
- Contact form: [/contact](/contact)