# auth.md

Agent access and registration policy for BLOMEGA.

BLOMEGA exposes two access tiers: an **open, public read tier** (no registration) and a
**licensed data tier** (agents register for scoped credentials).

## Audience

AI agents, LLM tools, and automated crawlers that read authoritative facts about BLOMEGA
and its off-the-shelf AI training dataset catalog, or that need licensed dataset delivery.

## Tier 1 - Public resources (no registration, no credentials)

Call these directly, unauthenticated (HTTP 200, no token):

| Resource | URL |
|---|---|
| Company facts (source of truth) | https://blomega.com/api/company/facts.json |
| Dataset catalog (schema.org DataCatalog) | https://blomega.com/datasets.json |
| API description (OpenAPI 3.1) | https://blomega.com/openapi.json |
| API catalog (RFC 9727) | https://blomega.com/.well-known/api-catalog |
| Service status | https://blomega.com/status.json |
| Integration guide | https://blomega.com/developers/agent-integration.html |

## Tier 2 - Agent registration for licensed data access

Agents that need licensed or non-public dataset delivery **must register** to obtain
scoped credentials. Registration is contact-provisioned (no self-serve OAuth server is
offered).

```
agent_auth:
  skill: blomega-data-access
  register_uri: https://blomega.com/developers/agent-integration.html
  registration_endpoint: mailto:hello@blomega.com
  methods_supported:
    - contact-provisioning
  bearer_methods_supported:
    - header
  steps:
    1. Submit a registration request to hello@blomega.com describing the datasets,
       intended use, and the agent/organization identity.
    2. BLOMEGA issues a licensing agreement / DPA defining scope and rights.
    3. Scoped delivery credentials (Bearer) are provisioned per engagement.
  credential_use: >
    Bearer credentials are issued per contract and used only for licensed delivery
    endpoints. They are not required for any Tier 1 public resource above.
```

## Authorization server

No OAuth authorization server is currently offered for automated (self-serve) agent
registration. Public resources are open and unauthenticated; licensed access is
registered and provisioned by contract via the endpoint above.