generated: '2026-09-19'
method: searched
source: >-
  a2a/getsincor-com-agent-card.json (no securitySchemes), well-known/getsincor-com-agent.json (deprecated
  `authentication` block), https://github.com/OrderofChaos33/SINCOR2/blob/main/docs/api/README.md
  (Authentication section), https://github.com/OrderofChaos33/SINCOR2/blob/main/docs/A2A_EXTERNAL_WIRE.md
  (the provider's own external probe log, 2026-09-10), the sdk/python and sdk/typescript clients in the same
  repository, and live anonymous probes of https://getsincor.com/api/a2a on 2026-09-20.
docs: https://github.com/OrderofChaos33/SINCOR2/blob/main/docs/api/README.md#authentication
checked: '2026-09-19'
derived_from: null   # no OpenAPI exists; derive-authentication.py found nothing to read
summary: >-
  SINCOR has no OpenAPI, so the auth profile is read from the agent card, the provider's API reference
  and observed behaviour. Three patterns coexist and they do not fully agree. (1) The A2A task surface
  (POST /api/a2a) accepts ANONYMOUS calls: the canonical card declares no securitySchemes, and the provider's
  own friction log records that message/send "accepts anonymous free calls" with caller_id=anonymous,
  free_call=true and simulation_mode, up to a free quota of 5 per skill; an invalid X-API-Key was ignored on
  our probe. (2) The API reference and the LEGACY card advertise an apiKey scheme in the X-API-Key header,
  "obtain a key at https://getsincor.com/api-keys" — that URL returns 404, so there is no public key
  issuance path today. (3) Paid skills are authorised by PAYMENT, not credentials: the quote says "pay N AXM
  to pay_to on Base (chain 8453), then include txHash in your tasks/send request"; the on-chain transfer
  to the treasury is the credential. Dashboard/admin routes under /api/auth use JWT bearer tokens
  (login → verify-token → profile), which is an operator surface rather than a developer one. Worker
  agents joining the inbound fabric register with a wallet + HMAC-SHA256 signature over the payload
  (/v1/a2a/register) and must heartbeat every 60 s or their KYA listing expires.
schemes:
  - id: anonymous-free-quota
    type: none
    applies_to: [POST /api/a2a message/send (free skills, first 5 calls), tasks/get, tasks/list, tasks/cancel, GET /api/a2a/quote, GET /api/a2a/agents, GET /docs/a2a, /.well-known/*]
    evidence:
      - source: https://github.com/OrderofChaos33/SINCOR2/blob/main/docs/A2A_EXTERNAL_WIRE.md
        quote: 'POST /api/a2a JSON-RPC message/send | 200. Task created. metadata.caller_id=anonymous, free_call=true, simulation_mode. Did not require the registered agent_id.'
      - source: live probe 2026-09-20
        detail: 'POST /api/a2a with X-API-Key: invalid returned the same -32602 skill-validation error as the anonymous request; tasks/list returned {"tasks": []} with no credential.'
    note: 'The quote says "FREE — include caller_id in your tasks/send request (no txHash needed)". caller_id is a self-asserted string, not a credential.'
  - id: apiKey
    type: apiKey
    in: header
    name: X-API-Key
    status: documented-but-not-observed
    applies_to: [POST /api/a2a (per docs/api/README.md)]
    key_issuance: https://getsincor.com/api-keys
    key_issuance_status: 404
    evidence:
      - source: https://github.com/OrderofChaos33/SINCOR2/blob/main/docs/api/README.md
        quote: 'A2A discovery and task execution — Agent Cards advertise an apiKey security scheme using the X-API-Key header.'
      - source: well-known/getsincor-com-agent.json
        quote: '"authentication": {"description": "Pass your API key in the X-API-Key header. Obtain a key at https://getsincor.com/api-keys.", "schemes": []}'
      - source: a2a/getsincor-com-agent-card.json
        detail: 'The canonical card declares NO securitySchemes and NO security, contradicting the docs.'
    note: >-
      Recorded because the provider documents it; not credited as an enforced scheme because the canonical
      card omits it, the issuance page is dead, and the live endpoint neither required nor validated it.
  - id: payment-as-authorization
    type: x-payment
    settlement: AXM (AXIOM) ERC-20 transfer on Base mainnet (eip155:8453) to treasury 0x09E2891432827D8835d2E9b83B25e2a5ba9612Ac, referenced by txHash in the task request
    applies_to: [paid skills — healthcare-credential-check, dental-billing-scrub, compliance-sbom, deal-scoring, cashflow-recovery, local-business-site-builder, toa-decision, contract-negotiation, quality-audit, agent-lifecycle, axiom-payment, and any free skill after its 5-call quota]
    platform_fee: 500 bps to the treasury (quote field platform_fee_bps)
    evidence:
      - source: https://getsincor.com/api/a2a/quote?skill_id=toa-decision
        quote: 'AXM-only. Pay 6.0000 AXM to pay_to on Base (chain 8453), then include txHash in your tasks/send request. Platform fee 500 bps routes to treasury 0x09E2891432827D8835d2E9b83B25e2a5ba9612Ac.'
      - source: a2a/getsincor-com-agent-card.json
        detail: 'paymentMethods[0] = {scheme: x402, network: base, chainId: 8453, acceptedTokens: [AXM, USDC, SINC], payTo: 0x09E2…12Ac}; baseCommerce.x402.enabled true.'
    note: >-
      Declared as "x402" on the card but executed as pay-first-then-reference; no HTTP 402 challenge was
      observed. The x402_pricing.yaml in the runtime prices some resources in SINC and healthcare-credential-check
      in USDC (5.0), while the live quote prices everything in AXM — the live quote is authoritative.
  - id: jwt-bearer
    type: http
    scheme: bearer
    bearerFormat: JWT
    applies_to: [POST /api/auth/login, POST /api/auth/verify-token, GET /api/auth/profile, GET /api/auth/admin/users]
    audience: dashboard / operator, not the developer API
    evidence:
      - source: https://github.com/OrderofChaos33/SINCOR2/blob/main/docs/api/README.md
        quote: 'Dashboard/admin API flows — JWT-backed endpoints under /api/auth rely on standard JWT bearer authorization headers.'
  - id: worker-registration-signature
    type: x-hmac
    algorithm: HMAC-SHA256 over the canonical JSON payload (sorted keys, no spaces), hex digest in `signature`
    applies_to: [POST /v1/a2a/register]
    then: [POST /v1/a2a/heartbeat every ≤60 s, POST /v1/a2a/bids, POST /v1/a2a/proofs, GET /v1/a2a/stream (SSE)]
    identity: wallet address on Base (chain_id 8453) + agent_id; KYA record states listed → bound → staked → verified
    evidence:
      - source: https://github.com/OrderofChaos33/SINCOR2/blob/main/sdk/python/sincor_a2a/__init__.py
        detail: 'register() signs {agent_id, name, capability_tags, rpc_callback, wallet, chain_id} with HMAC-SHA256; the TypeScript client instead POSTs the payload to /api/v1/sign (which returned 404 on 2026-09-20).'
      - source: live probe 2026-09-20
        detail: 'POST /v1/a2a/register {} → HTTP 400 {"error":"capability_tags required"}; GET /v1/kya/directory and GET /v1/quest → 200 JSON; GET /v1/a2a/stream → 200 text/event-stream.'
      - source: https://github.com/OrderofChaos33/SINCOR2/blob/main/docs/KYA_SPEC.md
        quote: 'Min stake: 10 AXM. Verify fee: 2 AXM. States: listed -> bound -> staked -> verified | revoked | expired'
    note: 'This is the surface for agents that want to SELL work into the swarm, not for callers buying it.'
oauth2: false
openid_connect: false
mutual_tls: false
gaps:
  - 'No securitySchemes on the canonical agent card, so an A2A client cannot discover the (documented) API-key scheme.'
  - 'The key-issuance page https://getsincor.com/api-keys returns 404.'
  - 'No /.well-known/oauth-authorization-server or oauth-protected-resource metadata; no dynamic client registration; no delegated identity path.'