# DataInfoMetrix auth.md - Agent Registration Policy

This document describes how autonomous AI agents, LLM crawlers, and programmatic systems register, authenticate, and obtain credentials for the [Data InfoMetrix](https://datainfometrix.com) platform and B2B intelligence services.

---

## 1. Organization & Service Overview
- **Service Name**: Data InfoMetrix B2B Technographic & Installed Base Intelligence
- **Canonical Domain**: `https://datainfometrix.com`
- **Supported Workflows**: B2B Installed Base Counts, Software User Lists, Total Addressable Market (TAM) Audience Calculations, Firmographic/Geographic Segmentation, and Verified Contact Datasets across 710+ Enterprise Technologies.
- **Support Contact**: `sales@datainfometrix.com` | `+1 (212) 461-3271`

---

## 2. Supported Registration & Authentication Flows

Data InfoMetrix implements three primary tiers of agent authorization:

### 2.1 `anonymous` (Zero-Auth Public Tool Access)
- **Description**: Autonomous agents may freely crawl, summarize, and query public discovery endpoints, catalog datasets, and interactive tools without registering an identity.
- **Allowed Actions**:
  - Ingestion of `/llms.txt`, `/llms-full.txt`, `/.well-known/ai-catalog.json`, and `/sitemap.xml`.
  - Read-only execution of WebMCP in-browser tools and public TAM calculators.
  - Submitting sample dataset requests via `POST /api/contact` with user email attribution.
- **Credentials Required**: None (`Authorization: None`).

### 2.2 `identity_assertion` / `verified_email` (Programmatic Registration Endpoint)
- **Description**: Programmatic agents acting on behalf of registered revenue teams or enterprise accounts obtain automated agent credentials using verified email or standard identity tokens.
- **Registration Endpoint**: `POST https://datainfometrix.com/api/auth/register`
- **Claim Endpoint**: `POST https://datainfometrix.com/api/auth/claim`
- **Supported Assertion Types**:
  - `verified_email`
  - `urn:ietf:params:oauth:token-type:id-jag`
- **Credential Returned**: Ephemeral Bearer token with scoped read/query permissions.

### 2.3 `bearer_token` (API Authorization)
- **Description**: Authenticated API calls and enterprise webhook queries must include standard HTTP Bearer tokens in the `Authorization` header.
- **Header Format**:
  ```http
  Authorization: Bearer <your_access_token>
  ```

---

## 3. Discovery Endpoints

AI agents can verify platform authorization capabilities via standard RFC discovery manifests:
- **OAuth Protected Resource Metadata (RFC 9728)**: `/.well-known/oauth-protected-resource`
- **OAuth 2.0 Authorization Server Metadata (RFC 8414)**: `/.well-known/oauth-authorization-server`
- **OpenID Connect Discovery**: `/.well-known/openid-configuration`
- **RFC 9727 API Catalog**: `/.well-known/api-catalog`
- **JSON Web Key Set (JWKS)**: `/.well-known/jwks.json`
- **Web Bot Auth Signatures**: `/.well-known/http-message-signatures-directory`

---

## 4. Politeness & Rate Limits
- **Public Request Limit**: 10 requests/sec per IP.
- **User-Agent Policy**: Include an identifiable agent name and contact URL in your `User-Agent` header (e.g. `User-Agent: MyAgent/1.0 (+https://example.com/bot)`).
- **Content Signals**: Data InfoMetrix declares `Content-Signal: search=yes, ai-train=yes, ai-input=yes` across all public interfaces.