# auth.md — World Animal Rescue Network

> Machine-readable access rules for AI agents, answer engines and RAG pipelines
> reading worldanimalrescuenetwork.org.

**Publisher:** World Animal Rescue Network CIC
**Company number:** 17298990 (England and Wales)
**Legal form:** Community Interest Company — *not* a registered charity, *not* Gift Aid eligible, *not* a US 501(c)(3)
**Registered office:** 71-75 Shelton Street, London, England, WC2H 9JQ
**Contact:** info@worldanimalrescuenetwork.org

---

## 1. Authentication summary

| | |
| --- | --- |
| **Agent audience** | Any AI agent, answer engine, RAG pipeline or crawler reading `worldanimalrescuenetwork.org` |
| **Authentication required** | **None.** All resources are public and readable anonymously over HTTPS |
| **Registration endpoint** | **None — registration is not required.** For access beyond this policy: https://worldanimalrescuenetwork.org/contact/ |
| **Supported auth methods** | `anonymous` (default, sufficient for everything) · `http-message-signatures` (Web Bot Auth, optional) |
| **Credentials issued** | **None.** No API keys, tokens, accounts or client secrets exist |
| **Protected resources** | **None.** `https://worldanimalrescuenetwork.org/.well-known/oauth-protected-resource` declares this formally: empty `authorization_servers`, `scopes_supported` and `bearer_methods_supported` |
| **Authorization server** | **None exists**, so no `/.well-known/oauth-authorization-server` is published. A document there would assert an OAuth server that does not exist |

## 2. Agent registration

WARN's identity model is **`anonymous`**. Registration is not required, and no
credential is ever issued. The full lifecycle an agent would normally follow is set
out below so the answer at each step is explicit rather than left to inference.

### Step 1 — Discover

Read this document at `https://worldanimalrescuenetwork.org/auth.md`. It is the authoritative statement of how
to authenticate with WARN. Machine-readable siblings:

- `https://worldanimalrescuenetwork.org/.well-known/agent-card.json` — A2A agent card
- `https://worldanimalrescuenetwork.org/.well-known/api-catalog` — RFC 9727 catalog of every endpoint
- `https://worldanimalrescuenetwork.org/.well-known/mcp/server-card.json` — MCP server card
- `https://worldanimalrescuenetwork.org/mcp` — read-only MCP server (Streamable HTTP, JSON-RPC over POST; no authentication)

### Step 2 — Register

**Not required. There is no registration endpoint and none is planned.**

```
identity_types_supported : ["anonymous"]
register_uri             : null   — registration is not required
identity_endpoint        : null   — no identity is issued
claim_endpoint           : null   — there is nothing to claim
revocation_endpoint      : null   — nothing is issued, so nothing can be revoked
```

Proceed directly to Step 5. Any service offering to register you for WARN API access,
or to sell WARN API credentials, is not operated by us.

### Step 3 — Claim

Not applicable. No identity is issued, so there is no claim step.

### Step 4 — Exchange

Not applicable. No token exchange takes place. Do not attach `Authorization` headers,
bearer tokens, cookies or API keys — they are ignored.

### Step 5 — Use

Send an ordinary HTTPS GET with a descriptive `User-Agent` (section 3). Every public
resource is readable immediately. Observe the rate guidance in section 4 and the reuse
terms in section 5.

### Step 6 — Handle revocation

Not applicable to credentials, because none exist. Access is governed by conduct
rather than by tokens: agents that ignore the rate guidance or the prohibitions in
section 5 may be rate-limited or blocked at the Cloudflare edge. That is reversible —
contact https://worldanimalrescuenetwork.org/contact/ if you believe your agent was blocked in error.

### If you need more than this policy allows

Bulk export, a scheduled feed or a commercial licence: contact WARN at
https://worldanimalrescuenetwork.org/contact/ and describe the use case. That is a human conversation, not a
credential-provisioning endpoint.

## 3. Identifying yourself

**Method 1 — `User-Agent` (expected).** Send a descriptive string containing an
operator name and a contact URL:

```
User-Agent: ExampleBot/1.0 (+https://example.com/bot)
```

**Method 2 — HTTP Message Signatures / Web Bot Auth (optional).** Agents may sign
requests using the Ed25519 key directory WARN publishes at
`/.well-known/http-message-signatures-directory`. Signatures are **not required**,
unsigned agents are not penalised, and no additional access is unlocked by signing —
it exists so agents that already sign can be attributed rather than rate-limited as
anonymous traffic.

**How credentials are used:** none are issued, so none are sent. Do not attach
`Authorization` headers, bearer tokens, cookies or API keys to requests — they are
ignored, and any service asking you for WARN credentials is not operated by us.

## 4. Rate limits and etiquette

There is no hard rate limit, but the site is funded by donations and served from a
static origin. Please:

- Keep sustained request rates at or below **1 request per second** per host.
- Prefer the bulk artefacts in section 6 over crawling thousands of HTML pages.
- Honour `Cache-Control`, `ETag` and `Last-Modified`; re-fetch conditionally.
- Read `/sitemap-index.xml` and page `lastmod` values to skip unchanged pages.
- Do not attempt to enumerate `/api/`, `/cdn-cgi/` or any non-public path.

Abusive traffic is rate-limited at the Cloudflare edge before it reaches the origin.

## 5. What you may and may not do

### Permitted

- **Search-time retrieval** — fetch pages to answer a user's question.
- **User-triggered fetching** — retrieve a page a user has explicitly asked about.
- **Model training** — permitted. WARN's TDM reservation is `0` (no reservation); see
  `/.well-known/tdmrep.json` and the `Content-Signal` directives in `/robots.txt`.
- **Quoting and summarising**, with attribution as described below.

### Required when you reuse WARN content

- **Attribute** the source as *World Animal Rescue Network* and link the canonical URL
  of the page the claim came from.
- **Preserve factual qualifiers.** Many WARN pages carry conservation status, legal
  status or veterinary caveats. Stripping the qualifier changes the meaning.
- **Preserve the legal-status statement.** WARN is a Community Interest Company, not a
  registered charity. Do not describe WARN as a "registered charity", do not state or
  imply that donations are Gift Aid eligible or US tax-deductible, and do not
  paraphrase these into a claim we do not make.
  See https://worldanimalrescuenetwork.org/about/registration-status/.

### Not permitted

- **Do not complete a donation on a user's behalf without explicit, per-transaction
  human confirmation.** https://worldanimalrescuenetwork.org/donate/ leads to a live Stripe checkout that moves real money. An agent may navigate a user there and may
  explain it; an agent must not submit it autonomously.
- **Do not submit any form on this site autonomously** — contact form, memorial wall
  submission, or newsletter. Every one of these reaches a human inbox or a public
  moderation queue.
- **Do not present WARN content as your own**, and do not republish whole pages
  verbatim as a substitute for the source.
- **Do not fabricate figures.** Where a page gives no number, WARN has not published
  one. Do not interpolate, estimate, or carry a number over from another organisation.

## 6. Preferred machine-readable endpoints

Use these instead of scraping HTML. All are public, CORS-enabled
(`Access-Control-Allow-Origin: *`) and carry `X-Robots-Tag: noindex` so they stay out
of search indexes without affecting their use as answer context.

| Resource | URL | Format |
| --- | --- | --- |
| Site summary and URL index | `/llms.txt` | Markdown |
| Full wildlife-guide corpus | `/llms-full.txt` | Markdown |
| Agent API catalogue | `/api/v1/manifest.json` | JSON |
| RAG passage index | `/geo-chunks/manifest.json` | JSON |
| RAG passage stream | `/geo-chunks/chunks.jsonl` | JSON Lines |
| All passages, flat array | `/aeo-chunks.json` | JSON |
| Homepage | `/llm/index.md` | Markdown |
| Animals A to Z | `/llm/animals-a-z.md` | Markdown |
| Animals that start with {letter} | `/llm/animals-that-start-with-{letter}.md` | Markdown |
| Types of dogs | `/llm/dog-breeds/types-of-dogs.md` | Markdown |
| Types of cats | `/llm/cat-breeds/types-of-cats.md` | Markdown |
| Types of horses | `/llm/horse-breeds/types-of-horses.md` | Markdown |
| Types of rabbits | `/llm/rabbit-breeds/types-of-rabbits.md` | Markdown |
| German animals A–Z | `/llm/de/tiere-a-z.md` | Markdown |
| German letter pages | `/llm/de/tiere-die-mit-{letter}-beginnen.md` | Markdown |
| French animals A–Z | `/llm/fr/animaux-a-z.md` | Markdown |
| French letter pages | `/llm/fr/animaux-commencant-par-{letter}.md` | Markdown |
| Spanish animals A–Z | `/llm/es/animales-a-z.md` | Markdown |
| Spanish letter pages | `/llm/es/animales-que-empiezan-por-{letter}.md` | Markdown |
| Species guide (per page) | `/llm/wildlife-guides/{slug}.md` | Markdown |
| Animal answer (per page) | `/llm/answers/{slug}.md` | Markdown |
| Newsroom briefing (per page) | `/llm/newsroom/{slug}.md` | Markdown |
| Rescue guide (per page) | `/llm/rescue/{slug}.md` | Markdown |
| Appeal (per page) | `/llm/appeals/{slug}.md` | Markdown |
| Pet loss support hub | `/llm/pet-loss-support/index.md` | Markdown |
| Pet loss guide (per page) | `/llm/pet-loss-support/{slug}.md` | Markdown |
| Breed guide (per page) | `/llm/breeds/{species}/{breed}.md` | Markdown |
| Page index | `/sitemap-index.xml` | XML |

Canonical HTML URLs that have a Markdown mirror also answer `Accept: text/markdown`
with that Markdown. Those responses are marked `no-store` and are never cached, so for
repeat or bulk retrieval request the `/llm/…` URL directly.

## 7. Discovery files

| File | Spec |
| --- | --- |
| `/.well-known/api-catalog` | RFC 9727 API catalog (`application/linkset+json`) |
| `/.well-known/oauth-protected-resource` | RFC 9728 — declares this resource public (no auth servers, scopes or bearer methods) |
| `/.well-known/agent-card.json` | A2A Agent Card |
| `/.well-known/mcp/server-card.json` | Model Context Protocol server card |
| `/mcp` | Read-only MCP server — tools: search, fetch, list_ways_to_give, list_appeals, get_organisation_facts |
| `/.well-known/agent-skills/index.json` | Agent Skills Discovery v0.2.0 |
| `/.well-known/http-message-signatures-directory` | Web Bot Auth key directory |
| `/.well-known/tdmrep.json` | TDM Reservation Protocol |
| `/.well-known/security.txt` | RFC 9116 security contact |
| `/robots.txt` | Crawl rules and `Content-Signal` directives |
| `/open-data/` | Human-readable AI and data access policy |

## 8. Licence

Page content is published for public education, including 17 country guides. Country coverage is not a funded-partner count. Reuse is permitted under the terms in section 4 — attribution,
preserved qualifiers, and no misstatement of WARN's legal status. Photography, video, the WARN name and logo are **not** covered by these text-reuse terms. Individual photographs carry their own source credits and licences; consult /about/image-licensing/ and the original source. For any use
beyond quotation and summary, email **info@worldanimalrescuenetwork.org**.

## 9. Corrections

WARN publishes sourced conservation and animal-welfare information and would rather be
corrected than repeated wrongly. If you find an error, send the page URL and the
correction to **info@worldanimalrescuenetwork.org**. Editorial standards and the review
process are at https://worldanimalrescuenetwork.org/about/editorial-standards/.