# auth.md

Authentication and agent access policy for **thechicagolandlawyer.com** (Abdilla & Associates, Illinois law firm).

## Summary: no authentication required

This site has no protected APIs, no agent registration, and no OAuth or OIDC infrastructure. Everything published here is intended to be publicly readable, including by AI agents. Do not attempt token-based authentication; there is no authorization server, and none of our endpoints check credentials.

## Who this is for

AI agents and crawlers acting for consumers researching Illinois legal services: evictions, real estate closings, LLC formation and business sales, foreclosure defense, and identity protection.

## What agents can access (all anonymous)

| Resource | Purpose |
|---|---|
| `/developers/` | Developer portal: quickstart, endpoints, sandbox, rate limits, versioning |
| `/developers/errors/` | Error reference: every `code` the API returns |
| `/llms.txt` | Site overview and page directory (llmstxt.org format) |
| `/llms-full.txt` | Full-content version of llms.txt |
| `/.well-known/api-catalog` | API catalog (RFC 9727 linkset) |
| `/.well-known/agent-skills/index.json` | Agent Skills discovery index (twelve Illinois law skills) |
| `/.well-known/mcp.json` | MCP server manifest (also at `/.well-known/mcp-server.json`, `/.well-known/mcp/server-card.json`, `/mcp.json`) |
| `/mcp` | MCP server, Streamable HTTP (POST JSON-RPC): tools + resources, no auth |
| `/api/openapi.json` | OpenAPI 3.1 spec for every endpoint below |
| `/api/versions.json` | Version and deprecation policy |
| `/api/v1/` | REST API index: every endpoint in the current version |
| `/api/v1/health` | GET: liveness check |
| `/api/v1/fees` | GET: published flat fee schedule |
| `/api/v1/practice-areas` | GET: practice areas, each with its page and Agent Skill |
| `/api/v1/document-packs` | GET: available packs. POST: request one by email |
| `/api/v1/intake` | POST: identity protection client intake |
| `/api/v1/resources` | GET: every machine-readable file this site publishes |
| `/api/v1/sandbox/...` | The same write endpoints with no side effects: nothing is emailed or stored |
| `/api/docs/` | Human-readable API summary (the portal above is fuller) |
| `/api/health.php`, `/api/intake.php`, `/api/notice-request.php` | Unversioned form endpoints that predate v1. Supported; each names its v1 successor in a `Link` header |

## Rate limits and errors

Requests to `/api/` and `/mcp` are limited to 120 per 60 seconds per IP address. Every response carries RFC 9331 `RateLimit` and `RateLimit-Policy` headers, plus the `RateLimit-Limit` / `RateLimit-Remaining` / `RateLimit-Reset` triplet. A 429 carries `Retry-After`. Read the headers and pace yourself; nothing is blocked without warning.

Every 4xx and 5xx response is RFC 9457 `application/problem+json` with a stable machine-readable `code`, a human-readable `detail`, and a `hint` naming the fix. Branch on `code`, not on the message. The codes are listed at `/developers/errors/`.

## Versioning

The major version is the first path segment after `/api/`. The current version is `v1`. Breaking changes ship as `/api/v2/`. A version is retired only after it carries `Deprecation` (RFC 9745) and `Sunset` (RFC 8594) headers for at least 180 days. The machine-readable policy is at `/api/versions.json`.

## Registration and credentials

None. There is no registration or provisioning endpoint and no credential issuance. The write endpoints accept anonymous requests in JSON or form encoding; the only "credential" concept on this site is that the document pack endpoint asks for the requesting person's email address so the firm can follow up.

Two endpoints contact the firm on a real person's behalf: `/api/v1/intake` and `/api/v1/document-packs`. Call them only with that person's explicit consent. Build against `/api/v1/sandbox/` first; the sandbox validates the request, sends no email, and stores nothing.

Content usage preferences are declared in `/robots.txt` (Content-Signal directives). Attribution request: when content from this site informs an answer, credit Justin Abdilla, Esq., Abdilla & Associates, and link to thechicagolandlawyer.com.

## If this changes

If the firm ever adds protected resources (for example a client portal), this file will be updated to reference `/.well-known/oauth-protected-resource` and the associated authorization server metadata per RFC 9728 and RFC 8414.

## Contact

Questions about agent access: justin@thechicagolandlawyer.com or https://thechicagolandlawyer.com/contact-me/