API

This site does not offer a public REST API for client matters. The endpoints below let agents and browsers discover resources through the RFC 9727 API catalog. No authentication is required; do not send an Authorization header.

Authentication

Every published endpoint is public and read-only. No API key, OAuth token, or cookie is required. Details: /auth.md.

Endpoints

• /.well-known/ai-catalog.json— ARD / AI Catalog capability list (MCP card, OpenAPI, agent skills)
• /.well-known/api-catalog— API catalog (application/linkset+json)
• /openapi.json— machine-readable OpenAPI 3.1 description
• /api/status.json— health status
• /llms.txt— curated site guide for agents
• /sitemap-index.xml— public page map
• /.well-known/agent-skills/index.json— Agent Skills discovery index (RFC v0.2.0)
• /.well-known/mcp/server-card.json— MCP Server Card (SEP-1649). This site has no MCP server; /mcp returns a JSON-RPC error.
• /auth.md— agent registration instructions (Auth.md). This site does not register agents; endpoints do not issue credentials.
• /.well-known/oauth-protected-resource— OAuth 2.0 protected resource metadata (RFC 9728). This site has no protected API; no access token is required.
• /.well-known/oauth-authorization-server— OAuth 2.0 discovery document (RFC 8414) and the agent_auth block. This site has no protected API; endpoints do not issue tokens.
• /.well-known/openid-configuration— OpenID Connect discovery document (same policy)

Example requests

curl -s https://fiorlaw.com/api/status.json
curl -sI https://fiorlaw.com/api/status.json | grep -i ratelimit
curl -s https://fiorlaw.com/openapi.json
curl -s -H "Accept: text/markdown" https://fiorlaw.com/

Rate limits

/api/ endpoints allow 120 requests per client IP every 60 seconds. Responses carry the IETF RateLimit-Policy and RateLimitfields (q quota, w window, r remaining,t seconds until reset) and, for compatibility,RateLimit-Limit, RateLimit-Remaining, andRateLimit-Reset. When the quota is exhausted the response is429 with Retry-After; agents should wait that long.

JSON errors

Unknown /api/ paths, and 404 or 405 responses that prefer JSON, returnRFC 9457application/problem+json: type, title,status, detail, code, resolution.

curl -s -D - -o - https://fiorlaw.com/api/does-not-exist
curl -s -H "Accept: application/problem+json" https://fiorlaw.com/no-such-page

• 404 api_route_not_found — Unknown /api/ path. Discover routes from the OpenAPI description or the API catalog.
• 404 page_not_found — No HTML page. See /llms.txt, the sitemap, or this document.
• 405 method_not_allowed — Only GET and HEAD. POST, PUT, PATCH, and DELETE are not accepted.
• 429 rate_limit_exceeded — Quota exhausted. Wait for Retry-After, then try again.

Missing HTML paths return a real HTTP 404. With Accept: text/markdownthe response is a short recovery note (sitemap, llms.txt, this document).

In-browser agents receive WebMCP tools when the page loads (navigator.modelContext.provideContext() /registerTool()): page navigation, practice areas, publications, team, and contact.

HTML is the default. Agents can request the Markdown twin of a page withAccept: text/markdown.