# auth.md - Agent Registration & Access Policy

Welcome to the API, content, and agent services for **Kurumsal Web Sitesi**.

You are an autonomous AI agent, LLM tool-calling client, or crawler. This service supports **agentic registration** (RFC 8414, RFC 9728, Auth.md) to discover, authenticate, and interact with our resources.

## Registration Flow

Follow the procedural steps below to register and receive credentials:

### 1. Discovery
- **OAuth Protected Resource Metadata (PRM):** [https://zamhesaplama.online/.well-known/oauth-protected-resource](https://zamhesaplama.online/.well-known/oauth-protected-resource)
- **OAuth Authorization Server Metadata:** [https://zamhesaplama.online/.well-known/oauth-authorization-server](https://zamhesaplama.online/.well-known/oauth-authorization-server)
- **Resource URI:** `https://zamhesaplama.online`
- **Issuer:** `https://zamhesaplama.online`

### 2. Registration & Identity Assertion
Submit your registration request to obtain access credentials:
- **Audience:** Autonomous AI agents, LLM tool-calling clients, and crawlers.
- **Registration Endpoint:** `POST https://zamhesaplama.online/api/agent/register`
- **Supported Identity Types:** `anonymous`, `identity_assertion`
- **Assertion Types Supported:** `urn:ietf:params:oauth:token-type:id-jag`, `verified_email`
- **Credential Types:** Bearer token (`Authorization: Bearer <token>`)

### 3. Token Claim & Revocation
- **Claim Endpoint:** `POST https://zamhesaplama.online/api/agent/claim`
- **Revocation Endpoint:** `POST https://zamhesaplama.online/api/agent/revoke`
- **Events Supported:** `https://schemas.openid.net/secevent/oauth/event-type/token-revocation`

## Public Content Access (No Auth Required)
All public pages, blog posts, corporate information, menus, FAQs, `llms.txt`, and catalog endpoints are **freely accessible without authentication** to autonomous AI agents, crawlers, and search engines.

- **Content Negotiation:** You can request `Accept: text/markdown` on any public page to receive clean, token-efficient Markdown.
- **Link Discovery:** Root and content responses include RFC 8288 `Link` headers pointing to `/.well-known/api-catalog` and `/.well-known/ai-catalog.json`.
- **Rate Limits:** Up to 120 unauthenticated requests per minute per IP.
- **Bot Verification:** We respect standard User-Agents conforming to RFC specifications.

## Contact & Security
- **Security Policy:** [https://zamhesaplama.online/.well-known/security.txt](https://zamhesaplama.online/.well-known/security.txt)
- **Canonical Website:** [https://zamhesaplama.online](https://zamhesaplama.online)