# auth.md

Orvik's machine surface is **anonymous and read-only**. There is nothing to register for, nothing
to authenticate with, and no credential that would grant more than an unauthenticated request
already gets.

| | |
|---|---|
| Identity type | `anonymous` |
| `register_uri` | `null` — there is no registration endpoint |
| `claim_uri` | `null` |
| `revocation_uri` | `null` |
| Authorization servers | none |
| Rate limit | none |
| Cost | none |

## Why there is no registration flow

Every endpoint is a static JSON file or a read-only computation over published reference tables.
Nothing is written, nothing is spent, and no user data is reachable — so there is nothing for an
access token to protect. Publishing an authorization-server document without an authorization
server would make the site misdescribe itself to every agent that read it, which is worse than
declaring none.

This means the WorkOS auth.md registration check cannot pass here, and that is the correct
outcome rather than an omission.

## The endpoints

| Surface | URL |
|---|---|
| API entry point | https://orvik.app/api/v1/index.json |
| OpenAPI 3.1 | https://orvik.app/api/v1/openapi.json |
| Human documentation | https://orvik.app/api/ |
| MCP (JSON-RPC 2.0, POST) | https://orvik.app/mcp |
| A2A (JSON-RPC 2.0, POST) | https://orvik.app/a2a |
| Protected resource metadata | https://orvik.app/.well-known/oauth-protected-resource |
| Skills | https://orvik.app/.well-known/agent-skills/index.json |

## Licence

The compilation is CC BY 4.0 — credit Orvik with a link. One upstream source inside the field data,
iNaturalist, is CC BY-NC 4.0, and that restriction travels with those columns.