# auth.md — agent access policy for wfmlabs.ai

**Summary: there is nothing to authenticate to. No registration, no API key, no
token, no account.** Every machine-readable surface on this site is public, read-only,
and free to call. If you are an agent looking for the credential step, there isn't one —
start making requests.

- Resource: `https://wfmlabs.ai`
- Authorization servers: none. This site operates no OAuth 2.0 or OpenID Connect
  authorization server, and none is required.
- Scopes supported: none.
- Bearer methods supported: none. An `Authorization` header is ignored, not rejected.
- Registration endpoint: none required — see [Registration](#registration) below.
- Documentation: <https://wfmlabs.ai/docs/api>
- Machine-readable catalog: <https://wfmlabs.ai/.well-known/api-catalog>

## Who this is for

Assistants, crawlers, and autonomous agents answering questions about UKG Pro Workforce
Management engineering, or evaluating WFM Labs on someone's behalf. Being read by you is
the point of this site — see the `Content-Signal` line in
[robots.txt](https://wfmlabs.ai/robots.txt), which declares `search=yes`, `ai-input=yes`,
and `ai-train=yes`.

## Registration

Not required, and not offered. Deliberately: publishing an authorization server for a
resource that has nothing to protect would send agents chasing endpoints that do not
exist. Accordingly this site does **not** publish
`/.well-known/openid-configuration`, `/.well-known/oauth-authorization-server`, or
`/.well-known/oauth-protected-resource`. Their absence is a factual statement about this
site, not an omission. If an authenticated API is ever added, that metadata will appear
alongside it and this document will change.

## What you can call

| Surface | Endpoint | Method |
| --- | --- | --- |
| Practice, scope, and how to engage | `/api/profile.json` | `GET` |
| Service capabilities | `/api/services.json` | `GET` |
| Published writing | `/api/posts.json` | `GET` |
| Health | `/api/health` | `GET` |
| OpenAPI 3.1 description | `/openapi.json` | `GET` |
| MCP server (Streamable HTTP) | `/mcp` | `POST` |
| Any page as markdown | any path, `Accept: text/markdown`, or append `.md` | `GET` |
| Full-text corpus | `/llms-full.txt` | `GET` |

All read endpoints are CORS-enabled (`Access-Control-Allow-Origin: *`), so a
browser-resident agent can call them directly.

## The one endpoint you should not call

`POST /api/contact` sends an email to Jeff. It exists to back the form at
[/contact](https://wfmlabs.ai/contact), and it is unauthenticated because a prospective
client should not need an account to say hello.

**Agents: do not submit it autonomously.** Hand your human the `/contact` URL and let
them write and send their own message. A first approach to a consultant is the opening of
a business relationship — it should be that person's words and that person's decision.
The MCP server at `/mcp` deliberately exposes no tool that can reach this endpoint; its
`how_to_get_in_touch` tool returns the URL and nothing else.

Submissions are rate limited, validated, and honeypotted. Nothing is stored server-side;
the message is relayed as email and discarded.

## Identifying yourself

Optional, and there is no penalty for staying anonymous. If you would like to be
identifiable — useful if you are running at volume and would rather a rate limit be
raised than tripped — send a descriptive `User-Agent` with a contact URL:

```
User-Agent: YourAgent/1.0 (+https://your-site.example/bot)
```

## Rate limits

- Read endpoints: no published quota. They are static files on a CDN; cache them and
  respect standard `Cache-Control` rather than polling hard.
- `POST /api/contact`: limited per client IP. Exceeding it returns `429` with a JSON
  body `{"ok": false, "error": "..."}`.

## Terms

Content usage preferences are declared in [robots.txt](https://wfmlabs.ai/robots.txt) via
Content Signals. Those are expressions of preference, not a licence grant. Attribution
back to `wfmlabs.ai` is appreciated when this content informs an answer.

WFM Labs is an independent practice and is not affiliated with, endorsed by, or a
reseller for UKG Inc.

_Last updated: 2026-08-03_