# QTravellers auth.md — Agent Registration and Authentication

> Agent registration metadata and authentication guide for the QTravellers Platform (`travellers.qticket.net`).  
> Operator contact: <mailto:support@qticket.net>.  
> Public discovery endpoints are open and read-only. User actions require an authorized token.

---

## 1. Agent Registration

QTravellers is Syria's comprehensive digital travel directory and tourism discovery guide. Public read-only endpoints (place search, categories, reviews, governorates, and articles) require no credentials and are accessible anonymously.

For autonomous AI agents intending to act on behalf of travelers or local businesses (such as submitting reviews, saving bookmarks, or managing listings), authentication is required.

This document describes how an operator can register an agent identity, claim an existing identifier, and revoke credentials.

---

## 2. Identity & Operator

- **Platform:** QTravellers (كيو ترافيلرز)
- **Domain:** `travellers.qticket.net`
- **Parent Platform:** QTicket (`qticket.net`)
- **Operator:** QTicket Engineering Team
- **Market:** Syrian Arab Republic
- **Support Contact:** <mailto:support@qticket.net>
- **Website:** https://travellers.qticket.net/

---

## 3. Supported Identity Types

### Anonymous (`anonymous`)
- **Access Level:** Full read-only access to places, governorates, categories, articles, and FAQs.
- **Credential:** None required for public read-only requests.
- **Claim URI:** https://travellers.qticket.net/agent/auth/claim

### Identity Assertion (`identity_assertion`)
- **Assertion Types Supported:**
  - `urn:ietf:params:oauth:token-type:id-jag` (Identity-based JWT assertion)
  - `verified_email` (Domain/operator verified email address)
- **Credential Types Supported:**
  - `api_key`
  - `bearer_token` (JWT via OAuth 2.0 Authorization Server)
- **Claim URI:** https://travellers.qticket.net/agent/auth/claim
- **Revocation URI:** https://travellers.qticket.net/agent/auth/revoke
- **Events Supported:**
  - `urn:ietf:params:oauth:event:revocation`

---

## 4. Discovery Catalog & Well-Known Endpoints

- **RFC 9264 API Catalog:** https://travellers.qticket.net/.well-known/api-catalog
- **LLM Summary:** https://travellers.qticket.net/llms.txt
- **OpenAPI 3.1:** https://travellers.qticket.net/openapi.json
- **MCP Server Card:** https://travellers.qticket.net/.well-known/mcp/server-card.json
- **A2A Agent Card:** https://travellers.qticket.net/.well-known/agent-card.json
- **Agent Skills:** https://travellers.qticket.net/.well-known/agent-skills/index.json
- **OAuth Server:** https://travellers.qticket.net/.well-known/oauth-authorization-server