# منصة أوشى للتدريب auth.md - AI Agent Registration & Authentication

## Audience
This document provides automated discovery, registration, and authentication instructions for autonomous AI agents, crawlers, and client applications interacting with منصة أوشى للتدريب.

## Agent Registration & Provisioning
- **Registration Endpoint:** `https://lms.aosha.sa/login/signup.php`
- **Token Endpoint:** `https://lms.aosha.sa/login/token.php`
- **Claim Endpoint:** `https://lms.aosha.sa/login/token.php`
- **Revocation Endpoint:** `https://lms.aosha.sa/login/logout.php`
- **Supported Identity Types:** `anonymous`, `identity_assertion`, `verified_email`
- **Supported Credential Types:** `bearer_token`, `token`

## Registration Flow
1. **Initiate:** The agent initiates registration at `https://lms.aosha.sa/login/signup.php` or provisions a token via `https://lms.aosha.sa/login/token.php`.
2. **Credential Provisioning:** The server provisions a token or bearer token.
3. **Claiming:** The agent binds the credential via `https://lms.aosha.sa/login/token.php`.
4. **Use Credential:** Send requests with header `Authorization: Bearer <TOKEN>` or query parameter `wstoken=<TOKEN>`.

## Public Discovery & Zero-Auth Access
Autonomous agents can freely inspect and read public course catalogs, syllabi, and API metadata without credentials:
- **LLMs Overview:** `https://lms.aosha.sa/llms.txt`
- **Full Syllabus Feed:** `https://lms.aosha.sa/theme/smartlearn/llms.php?full=1`
- **Markdown Negotiation:** Send `Accept: text/markdown` on any page or course URL.
- **RFC 9727 API Catalog:** `https://lms.aosha.sa/.well-known/api-catalog`
- **MCP Server Card:** `https://lms.aosha.sa/.well-known/mcp/server-card.json`
- **MCP JSON-RPC HTTP Endpoint:** `https://lms.aosha.sa/theme/smartlearn/api/mcp.php`

## Authenticated Access (Moodle Web Services)
To perform authenticated operations (course enrollment, submissions, grades):
1. Obtain an authorized token via `https://lms.aosha.sa/login/token.php` or from LMS administrator.
2. Pass the token via Authorization header or query parameter:
   - Header: `Authorization: Bearer <TOKEN>`
   - Query: `https://lms.aosha.sa/webservice/rest/server.php?wstoken=<TOKEN>&wsfunction=<FUNCTION>&moodlewsrestformat=json`

## OAuth & OpenID Connect Discovery
- **OAuth Protected Resource Metadata (PRM):** `https://lms.aosha.sa/.well-known/oauth-protected-resource`
- **OAuth Authorization Server (AS):** `https://lms.aosha.sa/.well-known/oauth-authorization-server`
- **OpenID Configuration:** `https://lms.aosha.sa/.well-known/openid-configuration`