# Nordic Society API

Public HTTP **discovery** surface for humans and agents. Interactive app data lives in Firebase (Auth + Firestore) behind Security Rules. Discovery documents do **not** grant privileged access.

## Base URL

`https://nordicsociety.org`

## Discovery (public)

| Resource | Path | Type |
|----------|------|------|
| API catalog (RFC 9727) | `/.well-known/api-catalog` | `application/linkset+json` |
| OpenAPI | `/openapi.json` | `application/openapi+json` |
| Health | `/health` | `application/json` |
| OAuth PRM (RFC 9728) | `/.well-known/oauth-protected-resource` | `application/json` |
| OAuth AS (RFC 8414) | `/.well-known/oauth-authorization-server` | `application/json` |
| OIDC discovery | `/.well-known/openid-configuration` | `application/json` |
| Agent auth skill | `/auth.md` | `text/markdown` |
| MCP server card | `/.well-known/mcp/server-card.json` | `application/json` |
| Agent skills index | `/.well-known/agent-skills/index.json` | `application/json` |
| MCP transport | `/mcp` | Streamable HTTP (public tools only) |
| Homepage markdown (live) | `/index.md` | `text/markdown` |
| llms.txt (live) | `/llms.txt` | `text/plain` |
| Events markdown (live, redacted) | `/events.md` | `text/markdown` |
| Events JSON (live, redacted) | `/events.json` | `application/json` |

## Authentication

- **Public:** discovery docs, health, MCP overview tools, markdown homepage, public event feeds.
- **Member actions:** Firebase ID token from the **web app** sign-in session (`Authorization: Bearer <idToken>` on existing callables).
- **`/oauth2/token` and `/agent/identity`:** discovery stubs — they **refuse** to issue privileged tokens (`401` / `501`).

See `/auth.md`.

## Content negotiation

Request HTML pages with `Accept: text/markdown` to receive a Markdown representation of the homepage (same body as `/index.md`, built from Admin SEO/About + published events).

Public event feeds never include attendees, emails, or check-in tokens.

## Sitemap

`/sitemap.xml` lists canonical public URLs and is referenced from `/robots.txt`.