# Authentication

Last updated: 2026-11-03

Public pages on bramwell.ai require no account, API key, or access token. An agent can read the holding-company pages, the markdown twins, llms.txt, the sitemap, and the company list without registering or signing in.

## Discover

There is no authorization server and no protected API. Start at https://bramwell.ai/llms.txt, which lists the public pages. The company list is https://bramwell.ai/portfolio.json. Its description is https://bramwell.ai/openapi.json.

## Pick a method

No authentication method is required. Do not send a bearer token. This site does not publish agent_auth, an identity_endpoint, identity_assertion, service_auth, or id-jag. It does not send a WWW-Authenticate challenge, because nothing on the public site is gated.

## Register

There is no client registration endpoint. Do not look for one.

## Claim

There is no claim endpoint.

## Exchange

There is no token endpoint and no token exchange. Do not request an access token.

## Use the access_token

Public reads do not use an access token. Request the page URL. Send Accept: text/markdown when you want the markdown twin.

## Errors

A JSON error is one object with three fields: error, message, and resolution. error is one of not_found, method_not_allowed, not_acceptable, unsupported_version. message says what failed. resolution says what to request instead.

An unknown path with Accept: application/json returns HTTP 404 and that object. The same path with Accept: text/html returns the HTML page. Accept: text/markdown, or a .md URL, returns markdown. The bytes do not vary by User-Agent.

An HTML page requested with Accept: application/json, when that type outranks HTML, returns HTTP 406 and that object. Other media types on a page return HTTP 406 as plain text.

POST, PUT, PATCH, and DELETE on /portfolio.json return HTTP 405, the Allow: GET header, and that object. The same status and object are returned for unsupported methods on the other public read documents.

An API-Version value other than 1 on GET /portfolio.json returns HTTP 400 and that object.

The OpenAPI description at /openapi.json references this object from every error response on the company list.

## Revocation

There are no credentials to revoke.