# Authentication for agents

**Venue Seating Wizard requires no authentication.** There are no API keys, no OAuth
clients, no bearer tokens and no `agent_auth` endpoints, because there is nothing private
to protect: every published endpoint is public and read-only, and the seating optimizer
itself runs client-side in the user's own browser rather than on a server. This document
exists so an agent can establish that in one fetch instead of probing for a 401.

## Discover

Start at <https://venue-seating-wizard.aviramk.com/api/v1/index.json>. Its `authentication` member is the string `none`, and the
same statement appears in <https://venue-seating-wizard.aviramk.com/api/v1/app.json> alongside `requires_account: false`. The
OpenAPI description at <https://venue-seating-wizard.aviramk.com/openapi.json> declares an empty root `security` array and an
empty `securitySchemes` object, which is the machine-readable form of "no credential is
accepted or required".

No `WWW-Authenticate` challenge will ever be returned, and no
`/.well-known/oauth-protected-resource` or `/.well-known/oauth-authorization-server`
document is published, because no authorization server exists. Their absence is the
answer, not a gap: treat a 404 on those paths as confirmation that this is an open
resource.

## Pick a method

There is one method: send an unauthenticated `GET`. Do not attach an `Authorization`
header — it will be ignored. Cross-origin fetches are allowed, so a browser-resident agent
can read the API directly.

```sh
curl -s https://venue-seating-wizard.aviramk.com/api/v1/csv-schema.json
```

## Register

Nothing to register. There is no client registration, no `register_uri`, no
`identity_assertion` exchange and no `id-jag` token, because the service issues no
credentials. An agent that would normally register first should skip straight to using the
endpoints.

## Claim

Nothing to claim. No `claim_uri` is advertised, and no credential is ever bound to an
agent identity.

## Use the credential

There is no credential to use. Fetch the endpoint you want and parse the JSON. The
operations are listed at <https://venue-seating-wizard.aviramk.com/api/v1/index.json> and described with typed response schemas
at <https://venue-seating-wizard.aviramk.com/openapi.json>.

## Errors

Errors are RFC 9457 problem documents served as `application/json`, carrying a stable
`code`, a human-readable `detail`, a `resolution` hint and a `documentation_url`. An
unrecognized path under `/api/` returns the `endpoint_not_found` document, whose `status`
member is `404`. Because the site is a static export with no request handler, that
document is delivered with a 200 transport status; the `status` member is authoritative.
No error is ever an authentication error.

## Revocation

Nothing to revoke, and no `revocation_uri` is advertised. If you need to stop using the
service, stop fetching it. Guest data never reaches the service in the first place, so
there is no session, no stored state and nothing to invalidate.

## Rate limits

Responses are static files served from a CDN, so there is no per-client quota and no
`RateLimit` header is emitted. Please cache the documents rather than polling them; they
change only when the tool's contract changes.