# Agent authentication on sabag3d.co.il

Everything an agent can do on this site works without a credential. There are no API keys, no OAuth, no accounts for agents and no paid tier.

## Discover

- MCP server: `https://sabag3d.co.il/mcp` (Streamable HTTP, JSON-RPC 2.0) — card at `https://sabag3d.co.il/.well-known/mcp/server-card.json`
- REST API: `https://sabag3d.co.il/api/v1` — OpenAPI 3.1 at `https://sabag3d.co.il/openapi.json`
- NLWeb: `https://sabag3d.co.il/ask`
- Catalog: `https://sabag3d.co.il/.well-known/ard.json`, API catalog `https://sabag3d.co.il/.well-known/api-catalog` (RFC 9727)

## Access

- All read endpoints are public: business details, services, projects, products, FAQ and search.
- One write action: a quote request (`POST /api/v1/quote-requests`, MCP tool `request_quote`). It needs no credential, but the person must have agreed to be contacted (`"consent": true`).
- Rate limits per IP, a minute: API 60, MCP 60 messages, /ask 30, markdown pages 60; quote requests 5 every 10 minutes. Site-wide caps also apply (all agents together), so retry after `Retry-After` on 429. Responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`.
- Send `Idempotency-Key` with a quote request so a retry does not create a second request.

## Not implemented

- OAuth 2.0 / OpenID Connect, RFC 9728 protected-resource metadata, and registration flows: nothing on this site is protected, so there is nothing to authorize.
- Customer accounts and orders are for people only, through the website: https://sabag3d.co.il/

## Contact

Questions: support@sabag3d.co.il (Sabag 3D Studio)