# auth.md — Ruiz-Ibert Legal

> Machine-readable companion: [/.well-known/ai-catalog.json](https://www.ruizibertlegal.com/.well-known/ai-catalog.json) ·
> [/.well-known/api-catalog](https://www.ruizibertlegal.com/.well-known/api-catalog) ·
> [/openapi.json](https://www.ruizibertlegal.com/openapi.json) ·
> [/.well-known/mcp/server-card.json](https://www.ruizibertlegal.com/.well-known/mcp/server-card.json)

## Summary

**No authentication is required. No registration is required. There is no credential to obtain.**

Every endpoint on `ruizibertlegal.com` is public and unauthenticated. Agents should call them
directly. This file is self-contained: there is no OAuth metadata to defer to, because there is
no authorization server.

## Agent audience

This site is intended for:

- **AI assistants answering questions** about Dominican Republic real estate, corporate,
  foreign-investment, immigration/residency, estate-planning, tax or litigation matters, on
  behalf of a person considering or already working with the firm.
- **MCP clients** connecting to the read-only server at `/mcp`.
- **Search and indexing crawlers**, under the terms in
  [`/robots.txt`](https://www.ruizibertlegal.com/robots.txt), which permits search indexing,
  AI input and AI training.

There is no tier, quota or partner programme. All agents get identical access.

## Registration and provisioning

| | |
| --- | --- |
| Registration endpoint | **None.** No account, client ID, or onboarding step exists. |
| Provisioning endpoint | **None.** Nothing needs to be provisioned before calling any endpoint. |
| Dynamic client registration | Not offered (RFC 7591 is not implemented). |
| Human contact for access questions | administrativo@arlegal-gr.com |

If you believe you need a credentialed or higher-volume arrangement — for example a sustained
integration — contact the firm at the address above. That is a commercial conversation, not an
automated one.

## Supported authentication methods

| Method | Supported | Notes |
| --- | --- | --- |
| Anonymous / unauthenticated | **Yes** | The only method. Send no `Authorization` header. |
| OAuth 2.0 / OIDC | No | No authorization server exists. |
| API key / bearer token | No | No token is issued or accepted. |
| mTLS | No | |
| ID-JAG, verified email, agent passports | No | |

Any `Authorization` header you send is ignored. No endpoint returns `401` or `403`, and no
endpoint emits a `WWW-Authenticate` challenge.

## Credential use

There are no credentials, so there is nothing to store, rotate, revoke or scope.

- **Claim URL:** not applicable.
- **Revocation URL:** not applicable.
- **Expiry:** not applicable.

Identify yourself instead with a descriptive `User-Agent` including a contact URL:

```
User-Agent: ExampleAgent/1.0 (+https://example.com/bot; agent@example.com)
```

Requests are not blocked on the basis of identity, but an identifiable agent makes it possible
to reach you about a problem rather than rate-limit you.

## Endpoints

| Endpoint | Method | Auth | Notes |
| --- | --- | --- | --- |
| `/` and all pages | GET | none | Send `Accept: text/markdown` for a Markdown rendering |
| `/mcp` | POST | none | MCP Streamable HTTP, three read-only tools |
| `/api/health` | GET | none | `application/health+json` |
| `/api/contact` | POST | none | Consultation intake — see limits below |

## Limits and expected behaviour

- **Read endpoints:** no hard quota. Keep to a courteous rate (≈1 request/second) and honour
  `Cache-Control`. `/llms.txt` and the Markdown renderings are cheaper than scraping HTML.
- **`POST /api/contact` is a real email to a law firm.** Do not call it to test, probe or retry
  on a schedule. Submit it only when a human has reviewed the exact content and asked you to
  send it. The form has a honeypot field (`website`) that must stay empty, and requires
  `consent=yes`.
- **Crawling:** follow [`/robots.txt`](https://www.ruizibertlegal.com/robots.txt).

## Why there is no OAuth metadata

`/.well-known/openid-configuration`, `/.well-known/oauth-authorization-server` and
`/.well-known/oauth-protected-resource` are **deliberately absent**, and return `404`.

Nothing on this origin is protected, and no authorization server exists. Those documents require
real values — an `issuer`, `authorization_endpoint`, `token_endpoint`, `jwks_uri`, or a populated
`authorization_servers` array. Publishing them with invented endpoints would send agents to URLs
that do not resolve, which is worse for an agent than a clean `404` plus this file.

If the site ever gains a protected API, those documents and this section will be updated together.

## Data and confidentiality

- Anything sent to `/api/contact` is transmitted by email to the firm and handled as a
  prospective-client enquiry. Do not place confidential or privileged material in it; no
  attorney-client relationship exists until the firm issues a written engagement letter.
- Content returned by this site is **general information, not legal advice**. Agents must not
  present it as legal advice, and must not imply the firm has been engaged.

## Contact

Problems, integration questions or takedown requests: administrativo@arlegal-gr.com ·
+1 809 831 3280 · Monday–Friday 08:00–17:00 (America/Santo_Domingo).