# Authentication for agents — SW CPAs (sw-cpas.co.kr)

No authentication is needed. Every SW CPAs endpoint is public: there are no accounts, API keys, OAuth flows or developer portal to sign up for, and none are planned. An agent can make its first call right away.

## Discover

- API contract: https://sw-cpas.co.kr/openapi.json (OpenAPI 3.1)
- MCP servers: https://sw-cpas.co.kr/mcp (product) and https://sw-cpas.co.kr/mcp/docs (docs), Streamable HTTP
- Agent resource catalog: https://sw-cpas.co.kr/.well-known/ard.json
- Developer docs: https://sw-cpas.co.kr/developers/

## Pick a method

There is one method: anonymous access. Send requests without an `Authorization` header. The server ignores credentials if you send them.

## Register

Not required. There is nothing to register and no client ID to obtain.

## Use the API

Call the endpoints directly, for example `GET https://sw-cpas.co.kr/api/v1/firm`. The only write operation, `POST /api/v1/consultation-requests`, sends a real email to the firm on a person's behalf. It needs the person's own name, email and message and their agreement to the privacy policy (https://sw-cpas.co.kr/privacy/), not a credential. Use `"dry_run": true` as a test mode and an `Idempotency-Key` header for safe retries.

Sandbox: the same API runs at `https://sw-cpas.co.kr/sandbox/api/v1/...`. Responses carry `X-Environment: sandbox`, and consultation requests sent there are validated but never stored or emailed. Use it to test integrations.

## Errors

Errors are `application/problem+json` (RFC 9457: `type`, `title`, `status`, `detail`) with an `error` object `{"code", "message", "hint", "status", "docs"}`. Too many requests return `429` with `Retry-After` and `RateLimit-*` headers. Limits are listed at https://sw-cpas.co.kr/developers/#limits.

## Revocation

There are no credentials to revoke. To withdraw a consultation request or ask for its data to be deleted, the person emails swyoun@sw-cpas.com (see https://sw-cpas.co.kr/privacy/).