generated: '2026-09-07'
method: probed
source: https://addisenergy.com/wp-json/ (authentication block of the live route index) plus live anonymous requests to every route in openapi/
description: >-
  Authentication profile for the WordPress core REST API behind addisenergy.com. There is no
  developer program, no signup, no API key issuance and no OAuth server. The public surface is
  anonymous and read-only; the write half of the same routes is gated by WordPress application
  passwords, which only an existing site administrator can mint from wp-admin.
apis:
- addis-energy:addis-energy-posts-api
- addis-energy:addis-energy-pages-api
- addis-energy:addis-energy-media-api
- addis-energy:addis-energy-taxonomy-api
- addis-energy:addis-energy-users-api
- addis-energy:addis-energy-search-api
- addis-energy:addis-energy-discovery-api
- addis-energy:addis-energy-oembed-api
anonymous_access:
  supported: true
  scope: read-only
  evidence: >-
    GET https://addisenergy.com/wp-json/wp/v2/posts?per_page=1 returned HTTP 200 with
    `Allow: GET` and `X-WP-Total: 13` on 2026-09-07 with no credentials of any kind.
  note: >-
    The public projection is limited to the WordPress `view` context. Anonymous callers see
    published objects only; no draft, private or edit-context field is returned.
schemes:
- id: none
  type: none
  name: Anonymous
  description: >-
    All eight APIs profiled here are readable with no credential. This is the entire public
    surface.
  applies_to: every GET operation in openapi/
  verified: 2026-09-07
- id: application-passwords
  type: http
  scheme: basic
  name: WordPress application passwords
  description: >-
    HTTP Basic with a WordPress username and an application password, declared by the server's own
    discovery document at https://addisenergy.com/wp-json/ under `authentication`. This is the only
    authentication method the site advertises. It is NOT a developer credential: application
    passwords are minted per-user from wp-admin by a signed-in site administrator, so there is no
    path for a third party to obtain one.
  authorization_endpoint: https://addisenergy.com/wp-admin/authorize-application.php
  applies_to: >-
    The POST/PUT/PATCH/DELETE half of the wp/v2 routes, plus the entirety of the
    contact-form-7/v1, code-snippets/v1, siteground-optimizer/v1, duplicator/v1 and
    wp-abilities/v1 namespaces.
  public_issuance: false
  verified: 2026-09-07
gated_surfaces:
- route: /wp/v2/settings
  status: 401
  code: rest_forbidden
  note: Site settings require an authenticated administrator.
- route: /wp-abilities/v1/abilities
  status: 401
  code: rest_forbidden
  note: The WordPress Abilities API is registered but administrator-only; no ability is anonymously enumerable.
- route: /contact-form-7/v1/contact-forms
  status: 403
  code: wpcf7_forbidden
  note: Contact Form 7 form definitions are not public. The public contact form posts to /feedback, which is not a documented integration surface.
- route: /wp/v2/comments
  status: 403
  code: rest_comment_disabled
  note: Comments are disabled site-wide, so the comments collection is unavailable even anonymously.
not_present:
  oauth2: false
  openid_connect: false
  mutual_tls: false
  api_keys: false
  jwt: false
  note: >-
    No OAuth authorization server, no OpenID Connect discovery document and no API-key programme
    exist. /.well-known/openid-configuration and /.well-known/oauth-authorization-server both
    returned 404 on 2026-09-07. scopes/ is therefore not applicable and is deliberately not emitted.