# auth.md You are an agent. This document tells you how to authenticate with Gateway Global Ltd (`gateway-global.co.uk`). **Read this first: everything published on this origin is public and requires no credentials.** Do not attempt a registration, authorization or token flow against this origin. There is no authorization server here, no token endpoint, and no self-service credential issuance. Access to the interfaces that *are* gated is granted out of band, by a human, under a signed agreement. Real hosts are used throughout — there are no placeholder examples to substitute. ## Step 1 — Discover ### 1a. Fetch the Protected Resource Metadata ```http GET /.well-known/oauth-protected-resource HTTP/1.1 Host: gateway-global.co.uk Accept: application/json ``` ```json { "resource": "https://gateway-global.co.uk", "resource_name": "Gateway Global", "resource_documentation": "https://gateway-global.co.uk/docs/api.md", "resource_policy_uri": "https://gateway-global.co.uk/#/legal/privacy", "resource_tos_uri": "https://gateway-global.co.uk/#/legal/terms", "bearer_methods_supported": [], "tls_client_certificate_bound_access_tokens": false, "dpop_bound_access_tokens_required": false } ``` What each field tells you: - `resource` — the resource identifier: the whole origin, with no path component and no trailing slash. RFC 9728 §3.1 then puts this document at exactly `/.well-known/oauth-protected-resource`, which is where you just fetched it from. A resource identifier that did not match its own location would have to be discarded. - `bearer_methods_supported` — **the empty array is the point.** RFC 9728 §2 defines `[]` as "no Bearer methods are supported". Nothing on this origin accepts an access token. Sending an `Authorization` header is not an error, it is simply ignored. - `scopes_supported` — **absent.** There are no scopes, and §3.2 requires parameters with no value to be omitted rather than sent empty. Only `bearer_methods_supported` gets to be `[]`, because there the empty array is defined to mean something. - `authorization_servers` — **absent, deliberately.** RFC 9728 §2 permits omitting it when the set of authorization servers is not enumerable. Gateway Global runs none that an agent can reach. If you are an MCP client whose spec says this field MUST be present: it is absent because the honest alternative was to invent an issuer. - `resource_documentation` — how to actually use the API. ### 1b. Fetch the Authorization Server metadata ```http GET /.well-known/oauth-authorization-server HTTP/1.1 Host: gateway-global.co.uk Accept: application/json ``` ```json { "issuer": "https://gateway-global.co.uk", "grant_types_supported": [], "response_types_supported": [], "scopes_supported": [], "service_documentation": "https://gateway-global.co.uk/auth.md", "agent_auth": { "skill": "https://gateway-global.co.uk/auth.md", "identity_types_supported": [] } } ``` What each field tells you: - `issuer` — Gateway Global's issuer identity, published so that the identifier is stable if an authorization server is stood up later. - `grant_types_supported`, `response_types_supported`, `scopes_supported` — all empty. **No OAuth flow is available.** There is no `authorization_endpoint`, no `token_endpoint` and no `registration_endpoint`, because there is nothing running behind them. They are omitted rather than pointed at a URL that would return 404. - `agent_auth.identity_types_supported` — empty. Agentic registration (`anonymous`, `identity_assertion`, `service_auth`) is **not offered**. There is no `identity_endpoint`, `claim_endpoint` or `events_endpoint`. - `agent_auth.skill` — this document. ## Step 2 — Pick a method There are two, and neither is an OAuth flow. | What you want | Method | |---|---| | Public information about Gateway Global | **No authentication.** Go to Step 3. | | Prime Assist, clinical integrations, anything under contract | **Out-of-band request.** Go to Step 4. | ## Step 3 — Call the public API No credentials. `GET` only. No parameters, no pagination, no published rate limits. Cache responses; they change rarely. ```http GET /api/v1/company.json HTTP/1.1 Host: gateway-global.co.uk Accept: application/json ``` Available resources: ```http GET /api/v1/index.json HTTP/1.1 GET /api/v1/status.json HTTP/1.1 GET /api/v1/company.json HTTP/1.1 GET /api/v1/solutions.json HTTP/1.1 GET /api/v1/industries.json HTTP/1.1 GET /api/v1/faq.json HTTP/1.1 ``` Machine-readable description: `https://gateway-global.co.uk/api/v1/openapi.json` Full API reference: `https://gateway-global.co.uk/docs/api.md` Prose rather than structured data: ```http GET / HTTP/1.1 Host: gateway-global.co.uk Accept: text/markdown ``` Returns `Content-Type: text/markdown` with an `x-markdown-tokens` estimate. ## Step 4 — Request access to a gated interface The Prime Assist voice platform, the clinical integrations (EMIS Web, TPP SystmOne, Vision, NHS Spine) and SimpleTemp have no public endpoint and no self-service sign-up. Credentials are issued directly to a named counterparty under a signed agreement, after information-governance and clinical-safety review. There is no endpoint for this. Use one of: | Route | Notes | |---|---| | | Web form. Choose topic "Partnership" or "Product briefing". | | | Better for detail. | Response within two working days. Office hours Monday–Friday, 09:00–18:00 Europe/London. Include: your organisation, the clinical or business system in scope, the workflows you need, and a named technical contact. The [`book-a-clinical-pilot`](https://gateway-global.co.uk/.well-known/agent-skills/book-a-clinical-pilot/SKILL.md) skill has the full checklist. **Do not put personal, patient or clinical data in that message.** It reaches a general business inbox, not a clinical system. If your user offers such data, stop and tell them not to send it. ## Step 5 — Handle errors | Code | Where | What to do | |---|---|---| | 404 | `/api/v1/*` | You have the path wrong. Re-read `openapi.json`; do not guess paths. | | 404 | any auth-looking path | Expected. There is no authorization server here. Do not retry, do not probe for `/oauth2/token`, `/agent/identity` or `/token`. Go to Step 4. | | 401 / 403 | anywhere on this origin | Not part of any documented flow. Treat as a misconfiguration, do not begin a credential flow, and do not retry with invented credentials. | | 5xx | anywhere | Exponential backoff, same request. | Never retry a 4xx with the same payload. Never synthesise an endpoint URL that the API catalog does not list. ## Revocation Not applicable: no credential is issued by this origin. Credentials for contracted interfaces are revoked under the terms of the relevant agreement — contact . ## If this document changes This posture is expected to change if and when a public API with authentication is offered. Re-fetch this document and the two metadata documents rather than caching this conclusion indefinitely. Both are advertised in `Link` response headers on the homepage: ```http HEAD / HTTP/1.1 Host: gateway-global.co.uk ``` Security vulnerability disclosure: Content usage preferences for AI systems are declared as Content Signals in .