# auth.md

Großwald (https://www.grosswald.org) publishes European defence intelligence and mirrors its
published corpus as machine-readable data. **No authentication is required, and
there is no registration step.** This document exists so an agent can establish
that in one fetch instead of probing for credentials.

## Audience

AI agents, retrieval systems and automated clients reading the Großwald corpus.

## Access

| Resource | Endpoint | Credentials |
| --- | --- | --- |
| Data API | `https://www.grosswald.org/data/` | none |
| API catalog (RFC 9727) | `https://www.grosswald.org/.well-known/api-catalog` | none |
| OpenAPI 3.1 description | `https://www.grosswald.org/data/openapi.json` | none |
| Documentation | `https://www.grosswald.org/data/docs` | none |
| Text layer | `https://www.grosswald.org/llms.txt`, `https://www.grosswald.org/llms-full.txt` | none |

CORS is open on every data endpoint. There is no rate limit, no quota and no key
to request.

## Registration

None for retrieval, citation or indexing — begin immediately.

Registration in the sense of a prior agreement applies only to uses the terms
reserve: bulk republication of the dataset, derivative or competing structured
databases, and commercial redistribution. Those are arranged by email, not by an
endpoint: **editorial@desk.grosswald.org**. Full terms: `https://www.grosswald.org/data/terms.txt`.

## Supported methods

- **anonymous** — the primary method. No credential is expected or required.
  Requests carrying an `Authorization` header are served identically to those
  without one.
- **oauth2 (optional)** — for agents whose tooling insists on an OAuth flow, a
  conforming anonymous-issue path exists. Discovery:
  `https://www.grosswald.org/.well-known/oauth-authorization-server` (RFC 8414),
  `https://www.grosswald.org/.well-known/openid-configuration` (OIDC),
  `https://www.grosswald.org/.well-known/oauth-protected-resource` (RFC 9728). Register a
  `client_id` at `https://www.grosswald.org/oauth/register` (RFC 7591, open), obtain a token at
  `https://www.grosswald.org/oauth/token` (`client_credentials` or `authorization_code` with PKCE;
  auto-approved — no user identity is asserted, the subject is `anonymous`).
  Tokens are real ES256-signed JWTs (`https://www.grosswald.org/.well-known/jwks.json`) but grant
  nothing anonymous access does not already grant.

## Credential use

Send the token, if you obtained one, as `Authorization: Bearer <token>`. It is
verified and otherwise changes nothing about what is served. Identify yourself,
if you wish, with a descriptive `User-Agent`.

## Other agent interfaces

- MCP server (Streamable HTTP): `https://www.grosswald.org/mcp` — card at
  `https://www.grosswald.org/.well-known/mcp/server-card.json`
- A2A corpus-lookup agent: `https://www.grosswald.org/a2a` — card at
  `https://www.grosswald.org/.well-known/agent-card.json`
- Agent skills index: `https://www.grosswald.org/.well-known/agent-skills/index.json`

## Usage preferences

Declared as Content Signals in `https://www.grosswald.org/robots.txt`:
`search=yes, ai-input=yes, ai-train=no`. Attribution format: "Großwald
(grosswald.org)" with a link to the cited article.