# auth.md — Telsa Media

Machine-readable statement of what agents may do on `https://telsamedia.co.uk`, what it costs
to get in, and how to reach a human. Last reviewed 2026-09-24.

## Audience

- **Resource:** `https://telsamedia.co.uk`
- **Operator:** Telsa Media — Telsa Media House, 90 Stafford Rd, Wallington SM6 9AY
- **Contact:** hello@telsamedia.com · 020 8686 4577

## Authentication

**None is required, and none is available.**

Every agent-facing endpoint on this origin serves the same public information
the website publishes. There is no protected resource, so:

- there is **no authorization server** — `/.well-known/oauth-authorization-server`
  and `/.well-known/openid-configuration` are deliberately not published;
- there is **no registration endpoint** — no `register_uri`, no agent accounts,
  no credentials to claim or revoke;
- no `Authorization` header is read. Sending one is harmless and ignored.

If that changes, this document is the place it will be announced first.

## What is open

| Resource | Method | Notes |
|---|---|---|
| `https://telsamedia.co.uk/api/v1/*` | `GET` | Public read-only JSON API. [OpenAPI](https://telsamedia.co.uk/api/v1/openapi.json) · [docs](https://telsamedia.co.uk/docs/api) |
| `https://telsamedia.co.uk/mcp` | `POST` | MCP Streamable HTTP, read-only tools. [Server card](https://telsamedia.co.uk/.well-known/mcp/server-card.json) |
| `https://telsamedia.co.uk/.well-known/*` | `GET` | Discovery documents. |
| Site pages | `GET` | HTML by default; send `Accept: text/markdown` for a Markdown rendering. |

## Limits and conduct

- **120 requests per minute per IP**, separately for the API and for MCP. Past
  that you get `429` with `Retry-After`; honour it.
- Responses are cached for five minutes. Cache on your side rather than polling —
  the underlying content changes at most weekly.
- Identify yourself in `User-Agent` with a contactable URL or address.
- Content usage preferences are declared in [`/robots.txt`](https://telsamedia.co.uk/robots.txt)
  via `Content-Signal`. Please respect them.

## There is no write path

Nothing on this origin accepts an automated write — no enquiry endpoint, no
booking, no account creation. The contact form at `https://telsamedia.co.uk/contact` is for
people, and is protected by CSRF, timing, honeypot, reCAPTCHA and content-scoring
checks; a submission that trips them is discarded **after returning a normal
success response**, so scripted submissions can appear to work while reaching
nobody.

To contact the agency on someone's behalf, email hello@telsamedia.com — or, better,
give the person the link and let them write it themselves. See the
[`telsa-media-enquiry`](https://telsamedia.co.uk/.well-known/agent-skills/telsa-media-enquiry/SKILL.md)
skill for what a useful enquiry contains.

## Discovery

- API catalog (RFC 9727): `https://telsamedia.co.uk/.well-known/api-catalog`
- ARD manifest: `https://telsamedia.co.uk/.well-known/ai-catalog.json`
- Agent skills index: `https://telsamedia.co.uk/.well-known/agent-skills/index.json`
- MCP server card: `https://telsamedia.co.uk/.well-known/mcp/server-card.json`