# BioTech Lab System auth.md

Agent and integration authentication for **BioTech Lab System API**.

## Audience

- WPlus Messenger / WhatsApp chatbot integrators (`/api/messenger/v1`)
- BioTech offline/online sync peers (`/api/sync`)
- Analyzer connectivity programs (`/api/instruments`)

## Machine-readable discovery

- Protected Resource Metadata (RFC 9728): [`/.well-known/oauth-protected-resource`](https://biotech.my-sys.online/.well-known/oauth-protected-resource)
- Authorization Server metadata (RFC 8414 + agent_auth): [`/.well-known/oauth-authorization-server`](https://biotech.my-sys.online/.well-known/oauth-authorization-server)
- API catalog (RFC 9727): [`/.well-known/api-catalog`](https://biotech.my-sys.online/.well-known/api-catalog)
- OpenAPI specs: [`/.well-known/apis/lab-sync/openapi.json`](https://biotech.my-sys.online/.well-known/apis/lab-sync/openapi.json)

## Registration model (service_auth)

BioTech Lab System does **not** expose automated `POST /agent/auth` self-registration.
Credentials are issued **human-in-the-loop** by a lab administrator:

1. **Messenger API key** — SmartLab platform admin or branch super-admin generates a Bearer key for `/api/messenger/v1`.
2. **Sync bearer token** — Branch settings → Sync: shared inbound/outbound token plus `X-Site-Code` per peer.
3. **Instrument login key** — Configured in lab instrument/LIS settings for `/api/instruments/*`.

Provisioning guide (GET, safe for passive discovery):
`https://biotech.my-sys.online/.well-known/agent-auth/provisioning`

## Supported credential use

Send credentials on every API request:

```http
Authorization: Bearer {API_KEY_OR_SYNC_TOKEN}
X-Site-Code: {branch_site_code}   # required for /api/sync only
Accept: application/json
```

## Scopes

- `messenger.read` — Read lab catalog, offers, and health via /api/messenger/v1
- `messenger.write` — Post leads, inbox events, assistant ask, results lookup
- `sync.read` — Pull lab data and settings via /api/sync (Bearer + X-Site-Code)
- `sync.write` — Push lab data via /api/sync
- `instruments.write` — Post instrument results and fetch barcode tests

## Issuer

`https://biotech.my-sys.online` (matches PRM `authorization_servers`)

## Resource

`https://biotech.my-sys.online/api/`

## Contact

- Vendor: Smart Lab System
- Support: https://biotech.my-sys.online/support-center