# ChamberBD auth.md

This document tells automated agents how to access ChamberBD's public discovery surfaces and how a human can provision a private ChamberBD account.

Last verified: 2026-09-01

## Audience and safety boundary

ChamberBD's agent-facing API and MCP server expose read-only public directory and educational content, and public facts about the ChamberBD software itself (plans and prices, verified features, what is not available yet). They do not expose patient records, prescriptions, appointments, account data, or write actions.

- Public API documentation: https://chamberbd.com/docs/api
- OpenAPI description: https://chamberbd.com/openapi.json
- MCP endpoint: https://chamberbd.com/api/v1/public/mcp
- MCP Server Card: https://chamberbd.com/.well-known/mcp/server-card.json
- Terms: https://chamberbd.com/terms
- Privacy: https://chamberbd.com/privacy

Health and medicine information is educational, not medical advice. Preserve canonical source URLs, last-reviewed dates, and disclaimers when quoting it. Never infer private patient information from public data.

## Discover authorization metadata

1. Fetch `https://chamberbd.com/.well-known/oauth-protected-resource`.
2. Read `authorization_servers`; the current issuer is `https://chamberbd.com`.
3. Fetch `https://chamberbd.com/.well-known/oauth-authorization-server`.
4. Read its `agent_auth` object before attempting registration or credential use.

## Anonymous public access

Supported identity type: `anonymous`.

Supported credential type: `none`.

The public API and public MCP tools require no account, API key, OAuth token, or bearer credential. Do not send a secret in an `Authorization` header. Calls are rate-limited and must comply with the published terms.

Example public request:

```http
GET /api/v1/public/medicines?q=paracetamol&limit=5 HTTP/1.1
Host: chamberbd.com
Accept: application/json
```

Example MCP initialization:

```http
POST /api/v1/public/mcp HTTP/1.1
Host: chamberbd.com
Content-Type: application/json
Accept: application/json, text/event-stream

{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"example-agent","version":"1.0.0"}}}
```

## Human-owned account provisioning and claim

Private doctor, staff, and clinic data is outside the anonymous agent surface. A human who wants a ChamberBD account must use the interactive registration page:

https://app.chamberbd.com/register

This is an interactive, verified-email account flow. It is not an agent Dynamic Client Registration endpoint, and agents must not automate it or create accounts without the user's explicit participation. ChamberBD does not currently accept ID-JAG or verified-email identity assertions from agent providers.

## Credential use and revocation

Anonymous public access issues no credential, so there is nothing to refresh or revoke. Human account sessions are managed inside the ChamberBD application; signed-in users can log out there. ChamberBD does not advertise an RFC 7009 token revocation endpoint or agent registration revocation event until those capabilities exist.

If an endpoint returns `401`, do not guess a token flow. Treat that endpoint as outside the public agent surface and direct the user to https://app.chamberbd.com/login.

## Contact

For security, account, correction, or data-removal questions, use https://chamberbd.com/contact.