# auth.md

Galen's machine surface is **anonymous and read-only**. There is nothing to register for,
nothing to authenticate with, and no credential that would grant more than an unauthenticated
request already gets.

| | |
|---|---|
| Identity type | `anonymous` |
| `register_uri` | `null` — there is no registration endpoint |
| `claim_uri` | `null` |
| `revocation_uri` | `null` |
| Authorization servers | none |
| Rate limit | none |
| Cost | none |

## Why there is no registration flow

Every endpoint is a static JSON file or a read-only computation over published reference data.
Nothing is written, nothing is spent, and no user data is reachable — the site has no account,
no form and no payment — so there is nothing for an access token to protect. Publishing an
authorization-server document without an authorization server would make the site misdescribe
itself to every agent that read it, which is worse than declaring none.

This means the WorkOS auth.md registration check cannot pass here, and that is the correct
outcome rather than an omission.

## The endpoints

| Surface | URL |
|---|---|
| API entry point | https://galen.vet/api/v1/index.json |
| OpenAPI 3.1 | https://galen.vet/api/v1/openapi.json |
| Human documentation | https://galen.vet/api/ |
| MCP (JSON-RPC 2.0, POST) | https://galen.vet/mcp |
| A2A (JSON-RPC 2.0, POST) | https://galen.vet/a2a |
| Protected resource metadata | https://galen.vet/.well-known/oauth-protected-resource |
| Skills | https://galen.vet/.well-known/agent-skills/index.json |

## Before you use any of it

Galen publishes no doses, does not diagnose, names no products and recommends none. An absent
row is never a statement of safety. If an animal is deteriorating or has swallowed something,
the answer is a veterinarian or an animal poison centre immediately. The full policy is at
https://galen.vet/api/v1/galen.json.

## Licence

The compilation is CC BY 4.0 — credit Galen with a link. The standards, guidelines and reference
works cited belong to the bodies that publish them.