# auth.md

You are an agent. This document tells you how to register credentials for **OncoCare** — oncology decision-support, RECIST 1.1 evaluation, CTCAE triage, and clinical EHR APIs. Follow the steps below for autonomous agent provisioning, authentication, and token management in compliance with RFC 8414, RFC 9728, and the Auth.md specification.

---

## Quick Discovery Metadata

- Issuer / Authorization Server: https://www.oncocare.tech
- Protected Resource: https://www.oncocare.tech
- OAuth Authorization Server: https://www.oncocare.tech/.well-known/oauth-authorization-server
- OIDC Configuration: https://www.oncocare.tech/.well-known/openid-configuration
- OAuth Protected Resource: https://www.oncocare.tech/.well-known/oauth-protected-resource
- API Catalog: https://www.oncocare.tech/.well-known/api-catalog
- MCP Server Card: https://www.oncocare.tech/.well-known/mcp/server-card.json
- Agent Skills Index: https://www.oncocare.tech/.well-known/agent-skills/index.json
- OpenAPI Specification: https://www.oncocare.tech/.well-known/openapi.yaml

---

## Step 1 — Provision Agent Credentials

Agents can register autonomously without human intervention to obtain immediate API access.

```http
POST /oauth/register HTTP/1.1
Host: www.oncocare.tech
Content-Type: application/json

{
  "client_name": "Autonomous-Oncology-Agent",
  "client_uri": "https://example.com/agent",
  "grant_types": ["client_credentials", "urn:ietf:params:oauth:grant-type:jwt-bearer"],
  "response_types": ["token"],
  "scope": "oncology:read mrecist:calculate patient:vitals"
}
```

Response (200 OK):

```json
{
  "clientId": "oncocare_agent_01ABC123",
  "apiKey": "onco_live_sk_7f8a9b0c1d2e3f4a5b6c7d8e9f",
  "claimToken": "clm_oncocare_8a7b6c5d4e3f2a1b",
  "tokenType": "Bearer",
  "expiresIn": 86400
}
```

Credential definitions:
- `apiKey`: Your bearer access token. Use it immediately in clinical API requests.
- `clientId`: Identifies your registered agent instance across sessions.
- `claimToken`: Single-use verification token if human clinician supervisor linkage is requested.

---

## Step 2 — Use the Credential

Include the issued API key as a Bearer token in the `Authorization` request header:

```http
GET /api/v1/oncology/guidelines HTTP/1.1
Host: www.oncocare.tech
Authorization: Bearer <apiKey>
Accept: application/json
```

Or execute mRECIST 1.1 tumor response calculations:

```http
POST /api/v1/tools/mrecist-calculate HTTP/1.1
Host: www.oncocare.tech
Authorization: Bearer <apiKey>
Content-Type: application/json

{
  "target_lesions_baseline_mm": [32, 24, 18],
  "target_lesions_followup_mm": [20, 14, 10],
  "new_lesions_present": false,
  "non_target_progression": false
}
```

---

## Step 3 — Claim Ceremony (Optional)

When an autonomous agent needs to associate its telemetry or triage recommendations with a verified hospital or oncologist account:

```http
POST /oauth/claim HTTP/1.1
Host: www.oncocare.tech
Content-Type: application/json

{
  "claimToken": "clm_oncocare_8a7b6c5d4e3f2a1b",
  "supervisor_email": "oncologist@hospital.org"
}
```

---

## Step 4 — Revoke Credentials

Agents or supervising platforms can revoke active tokens at any time:

```http
POST /oauth/revoke HTTP/1.1
Host: www.oncocare.tech
Content-Type: application/x-www-form-urlencoded

token=<apiKey>&token_type_hint=access_token
```

---

## Supported Scopes

| Scope | Description |
| :--- | :--- |
| `openid` | Standard OpenID Connect user identity verification |
| `oncology:read` | Read oncology clinical guidelines, drug regimens, and staging rules |
| `oncology:write` | Submit patient-reported outcome measures (PROMs) and toxicity logs |
| `fhir:read` | Read FHIR R4 oncology profile bundles (mCODE compliant) |
| `patient:vitals` | Stream continuous biometric and temperature monitoring data |
| `emr:protocols` | Query NCCN/ICMR chemotherapy protocol templates and BSA formulas |
| `mrecist:calculate` | Execute RECIST 1.1 and mRECIST tumor response calculations |

---

## Clinical Safety & Regulatory Guardrails

1. **ICMR 2023 AI Ethics Compliance**: AI agents operate in an assistive role only. Prescriptions, chemotherapy orders, and regimen modifications require explicit authorization by a Registered Medical Oncologist.
2. **DPDP Act 2023 & HIPAA Compliance**: All patient health data must remain encrypted in transit (TLS 1.3) and at rest (AES-256).
3. **Contact Support**: Operations & Clinician Partner Team: support@toshikohealth.com | Tel: +91 22 31846644.