# auth.md

This document describes how AI agents can access QuadrantX resources at
`https://quadrantx.io`. QuadrantX is built and operated by Couch & Associates.
It follows the WorkOS `auth.md` agent-registration schema
(https://github.com/workos/auth.md) so that agents and scanners expecting that
surface can parse it.

**Resource server**: `https://quadrantx.io`
**Authorization server**: `https://quadrantx.io` (self-issued, public access)

Scope note: this file covers the QuadrantX marketing and data site only. The
QuadrantX dashboard application at `https://dashboard.quadrantx.io` is a
separate, account-gated product with its own sign-in and is out of scope here
(see section 7).

## 1. Discover

Everything on `quadrantx.io` is publicly accessible. No authentication is
required to read any page, article, discovery document, or data file.

Fetch the Protected Resource Metadata to confirm:

```http
GET https://quadrantx.io/.well-known/oauth-protected-resource
```

Read the `authorization_servers` array to find the authorization server, then
fetch its metadata:

```http
GET https://quadrantx.io/.well-known/oauth-authorization-server
```

Read the `agent_auth` block for the supported identity types. Its `skill`
field points back to this document.

## 2. Pick a method

QuadrantX supports only `anonymous` access. No identity assertion, service
credential, or user claim ceremony is required. Agents may begin using
resources immediately.

Cross-check: the `agent_auth.identity_types_supported` array in the
Authorization Server metadata is `["anonymous"]`.

## 3. Register

No registration is required. All endpoints are open to anonymous access, and
there is no registration endpoint to call (`agent_auth.register_uri` is empty).

Agents should identify themselves with a descriptive `User-Agent` header when
making requests. This is a courtesy, not a requirement. Crawler policy for
training, search, and user-triggered fetches is declared in
https://quadrantx.io/robots.txt and in the `Content-Signal` response header.

## 4. Use the credential

No credential is needed. Make requests directly, with no `Authorization`
header. For example, the free QuadrantX agent-readiness scanner is a public
JSON endpoint that accepts an anonymous POST:

```http
POST https://quadrantx.io/agent-ready/scan.php
Content-Type: application/json

{
  "url": "https://example.com"
}
```

It returns `application/json`: a readiness report for the target site with
per-check pass/fail results, evidence, and a five-tier score. Please limit
scans to a few per minute; the endpoint fetches the target site on your behalf.

Read-only resources use plain GET, again with no credential:

```http
GET https://quadrantx.io/data/snapshot/manifest.json
Accept: application/json
```

Useful public resources, all readable without a token:

```bash
# Site summary for LLMs (markdown)
curl -sL https://quadrantx.io/llms.txt

# Detailed content map, including every Insights article
curl -sL https://quadrantx.io/llms-full.txt

# Structured article feed
curl -sL https://quadrantx.io/insights/articles.json

# Data snapshot: manifest (license, attribution, pointers), then leaders index
curl -sL https://quadrantx.io/data/snapshot/manifest.json
curl -sL https://quadrantx.io/data/snapshot/leaders.json

# One category, all four quadrants with vendor scores
curl -sL https://quadrantx.io/data/snapshot/categories/expense-management-software.json

# Machine-readable discovery surfaces
curl -sL https://quadrantx.io/.well-known/api-catalog
curl -sL https://quadrantx.io/.well-known/ard.json
curl -sL https://quadrantx.io/.well-known/agent-card.json
curl -sL https://quadrantx.io/.well-known/mcp/server-card.json
curl -sL https://quadrantx.io/.well-known/agent-skills/index.json
```

The data snapshot is published under CC-BY-4.0. Cite it as stated in
`manifest.json` ("QuadrantX, Couch & Associates (2026-Q2 snapshot)"). Please
cache responses and be a polite client.

## 5. Handle revoke

There are no credentials to revoke. Access policy changes, if any, will be
reflected in `robots.txt`, the `Content-Signal` header, and this document.

## 6. Errors

| Code | Meaning | Action |
|------|---------|--------|
| 200 | Success | Parse the response (markdown, JSON, or HTML as declared) |
| 301 | Canonical redirect | Follow it; extensionless URLs are canonical |
| 404 | Resource does not exist | Check the URL against `llms-full.txt` or the sitemap |
| 406 | Accept header not satisfiable by a static file | Retry with `Accept: */*` |
| 400 | Scanner rejected the request | Send a JSON body with a valid absolute `url` |
| 405 | Wrong HTTP method on the scanner | Use POST (or GET with `?url=`) |
| 429 | Scanner rate limit reached | Wait and retry; keep to a few scans per minute |

## 7. Additional resources

- **LLM site summary**: https://quadrantx.io/llms.txt
- **Full content map**: https://quadrantx.io/llms-full.txt
- **ARD manifest**: https://quadrantx.io/.well-known/ard.json
- **MCP Server Card**: https://quadrantx.io/.well-known/mcp/server-card.json
- **A2A Agent Card**: https://quadrantx.io/.well-known/agent-card.json
- **API Catalog**: https://quadrantx.io/.well-known/api-catalog
- **Agent Skills**: https://quadrantx.io/.well-known/agent-skills/index.json
- **QuadrantX dashboard** (separate application, account required): accounts are
  created by a person at https://dashboard.quadrantx.io/signup, verified by
  email, and approved by QuadrantX. There is no automated or agent-initiated
  registration, and agents should not attempt to create accounts on a user's
  behalf.
- **Contact**: https://couch.associates/contact