# Authentication & Machine Access Policy (Auth.md)
> Call Center Options, LLC (https://ccoptions.net)

## Public Access (Zero Auth Required)
All informational content, clinical service specifications, compliance documentation, HIPAA architecture details, pricing tables, and research insights on `https://ccoptions.net` are publicly accessible without authentication.
- Format: HTML or Markdown (via `Accept: text/markdown` or `?format=markdown`)
- Discovery files: `/llms.txt`, `/sitemap.xml`, `/.well-known/api-catalog`, `/.well-known/ai-catalog.json`

---

## Agent Registration

Automated agents and AI systems can register to interact with Call Center Options APIs, discovery tools, and intake pipelines.

### Registration Endpoint
- **Register URI**: `https://ccoptions.net/oauth/register`
- **Method**: `POST`
- **Content-Type**: `application/json`
- **OAuth Authorization Server**: `https://ccoptions.net/.well-known/oauth-authorization-server`
- **OAuth Protected Resource**: `https://ccoptions.net/.well-known/oauth-protected-resource`

### Supported Identity Types
- `did` (Decentralized Identifiers / W3C DID)
- `web` (Web Domain Identity / RFC 9727)
- `x509` (Public Key Infrastructure Certificates)
- `agent-card` (A2A Agent Card Identity)

### Supported Credential Types
- `client_credentials` (OAuth 2.0 Client Credentials Grant)
- `bearer_token` (Signed JSON Web Tokens / RFC 7519)
- `mtls` (Mutual TLS Client Authentication)

### Lifecycle Endpoints
- **Claim URL**: `https://ccoptions.net/oauth/claim`
- **Revocation URL**: `https://ccoptions.net/oauth/revoke`
- **JWKS URI**: `https://ccoptions.net/.well-known/jwks.json`

---

## Automated Clinic Lead Submissions (Open Intake)
AI agents acting on behalf of medical clinics or practice managers may submit practice staffing requests directly via HTTP POST:
`POST https://ccoptions.net/leads`
- **Authentication**: Open public intake (Zero Bearer token required).
- **Rate Limiting**: 20 requests per IP per hour.
- **Required Headers**:
  - `Accept: application/json`
  - `Content-Type: application/json`
- **Required Fields**:
  - `clinic_name`: Practice name (string)
  - `contact_name`: Administrator or physician contact name (string)
  - `email`: Valid clinical business email (string)
  - `phone`: Contact telephone (string)
  - `requested_ftes`: Number of dedicated FTEs requested (integer, minimum 1)

---

## Internal Systems Access (Restricted)
Electronic Health Record (EHR) systems, practice management portals, and client clinical workflows are accessible **only by authorized human staff** inside stateside Amazon (AWS) Workspaces enclaves protected by multi-factor authentication (MFA) and biometric physical facility controls. No external bot access is granted to patient PHI.