# RapidStart Public API Authentication and Permissions

Canonical: https://www.rapidstart.com/auth.md

## Public, read-only access

POST https://www.rapidstart.com/api/v1/knowledge and the compatibility endpoint /api/webmcp return public product knowledge and country-level partner information. https://www.rapidstart.com/api/mcp exposes the same public research capabilities through MCP.

Authentication: none. API keys: none. Required OAuth scopes: none. Do not send bearer tokens, client secrets, personal data, or customer CRM records. OpenAPI declares security: [] globally and on each public operation.

The allowed capabilities are catalog listing, product knowledge search, and country-level partner lookup. None can modify a record, access a customer environment, register a user, initiate checkout, or deploy software.

## Separate product authentication

Microsoft sign-in, customer tenant consent, and product permissions described on product pages belong to those products and their own services. This website is not an OAuth authorization server for those services. It does not issue tokens or advertise protected-resource scopes on their behalf.

A future protected API requires a confirmed authorization provider, resource audience, supported grants, and least-privilege permissions enforced by the API. Until that exists, publishing OAuth authorization-server or protected-resource metadata here would misrepresent the service.

- [OpenAPI specification](https://www.rapidstart.com/openapi.json)
- [Agent and API guide](https://www.rapidstart.com/agent-guide.md)