# Auth.md

Mindcat's public APIs do not require authentication. Agents may freely read content and submit contact requests without credentials.

## Available Endpoints

### Contact Form API
- **URL**: `POST https://mindcat.ai/api/contact`
- **Auth**: None required
- **Rate limit**: 10 requests per 15 minutes per IP
- **Body** (JSON):
  ```json
  {
    "first_name": "string (optional, max 40 chars — required if name omitted)",
    "last_name": "string (optional, max 40 chars)",
    "name": "string (optional, 2–100 chars — required if first_name omitted)",
    "email": "string (required, valid email, max 80 chars)",
    "company": "string (required, max 255 chars)",
    "street": "string (optional, max 255 chars — defaults to Not provided server-side)",
    "phone": "string (optional, max 40 chars)",
    "message": "string (optional, max 1000 chars)",
    "description": "string (optional, max 1000 chars — alias for message)"
  }
  ```
  Provide **either** `first_name` **or** `name`. `company` and `email` are always required.
- **Success response**: `200 { "success": true, "message": "..." }` with rate-limit headers
- **Error responses**: `400` validation error, `429` rate limited, `500` server error

### OpenAPI Specification
Full machine-readable API spec: `https://mindcat.ai/openapi.json`

### API Catalog (RFC 9727)
`https://mindcat.ai/.well-known/api-catalog`

### Site overview (Markdown)
`GET https://mindcat.ai/api/markdown` — site overview for agents. Per-path summaries: `GET https://mindcat.ai/api/markdown?path=/contact`

## Content Access

All public pages are freely readable by agents. See `Content-Signal` in `robots.txt` for AI usage preferences. Agent index: `https://mindcat.ai/llms.txt`

## Contact

For API access questions or partnership enquiries: hello@mindcat.ai

## Agent Authentication

```yaml
agent_auth:
  registration_required: false
  credentials_required: false
  public_endpoints:
    - path: "POST /api/contact"
      description: "Submit a contact request. Rate-limited to 10 req/15 min per IP."
    - path: "GET /**"
      description: "All public pages and static content are freely readable."
  notes: >
    Mindcat has no protected APIs. Agents may call /api/contact and read all
    public content without registration, API keys, or any credentials.
    The only constraint is the contact endpoint rate limit (10 req / 15 min per IP).
```