# Coastline Index auth.md

> Coastline Index exposes public, read-only GTA VI reference endpoints. No account or private user data is required.

## Agent registration

- Registration: not required.
- Agent registration required: no.
- Agent registration URL or endpoint: none; there is no sign-up workflow.
- Agent registration instructions: do not create an account. REST endpoints use unauthenticated GET, HEAD or OPTIONS; the Remote MCP Beta uses unauthenticated POST or OPTIONS.
- User delegation: not supported or needed because these endpoints expose no private user resources.

## Agent login and authentication

- Login: not required.
- Agent login required: no.
- Login URL or endpoint: none; there is no login workflow.
- API key: not required.
- OAuth or bearer token: not required.
- Cookies: not required for API access.
- Persistent MCP session: not used or supported.

## Public endpoints

- `https://coastlineindex.com/api/entities` — list and filter entities.
- `https://coastlineindex.com/api/entities/{slug}` — retrieve one entity and its sources.
- `https://coastlineindex.com/api/facts?q=PC` — search verified facts, direct answers and claim checks.
- `https://coastlineindex.com/api/changes?since=2026-08-25` — list editorially reviewed fact changes.
- `https://coastlineindex.com/api/status` — retrieve release and official-event state.
- `https://coastlineindex.com/api/mcp` — public read-only Remote MCP Beta; use POST with protocol 2026-07-28.
- `https://coastlineindex.com/.well-known/mcp/server-card.json` — public MCP Server Card for discovery; use GET, HEAD or OPTIONS.
- `https://coastlineindex.com/api/a2a` — stateless read-only A2A Evidence Agent Beta; use JSON-RPC SendMessage with A2A-Version 1.0.
- `https://coastlineindex.com/.well-known/agent-card.json` — public A2A Agent Card; use GET, HEAD or OPTIONS.
- `https://coastlineindex.com/.well-known/agent-skills/index.json` — public Agent Skills discovery index.
- `https://coastlineindex.com/openapi.json` — OpenAPI description.
- `https://coastlineindex.com/.well-known/api-catalog` — RFC 9727 API catalog.

## Remote MCP Beta tools

- `search_verified_facts`
- `get_entity_with_sources`
- `get_release_and_event_status`
- `list_verified_changes_since`

## Boundaries

- All endpoints are retrieval-only; there are no write, purchase, account or administrative operations.
- Remote MCP has no OAuth, API key, cookie, user delegation, persistent session, prompt, write tool or external URL fetch.
- The A2A Beta accepts text-only SendMessage requests, returns direct messages, and does not persist tasks, contexts, request bodies or identifiers.
- Remote MCP tool calls share a 60-per-minute quota in each Cloudflare edge location; discovery and resource reads do not consume it.
- The rate limiter uses one fixed service key, not an IP address, account, device, session or installation identifier.
- MCP output is currently zh-CN and reads only the same editorially reviewed published dataset as the site; raw Source Change Monitor observations are never exposed.
- The verified-change ledger is complete from 2026-08-25. Earlier records are a reviewed subset, not a complete history.
- Coastline Index is unofficial. If its data conflicts with Rockstar or a first-party store, the official source controls.
- Scheduled times do not prove that an event is live or that a replay exists; use the returned confirmation fields.
- Clients should cache according to response headers and avoid excessive request rates.