specification: API Commons Authentication
specificationVersion: '0.1'
provider: Administration for Community Living (ACL)
providerId: administration-for-community-living-acl-
generated: '2026-08-30'
method: probed
source: >-
  Live probes of https://sic.acl.gov/p-agid-ui-fn and https://ehc.acl.gov/api,
  plus the AGID front-end bundle https://agid.acl.gov/assets/index-2c03a0f9.js
  which declares the gateway base URL and header name.
description: >-
  ACL publishes no developer authentication documentation. Two live ACL API hosts
  were discovered by reading the public front-end bundles of ACL's own web
  properties; this artifact records the authentication model each one actually
  enforces, observed on the wire. Neither surface has a signup, a key-issuance
  flow, or a documented auth page.
schemes:
  - id: agid-apim-subscription-key
    api: AGID Program Data API
    host: sic.acl.gov
    base: https://sic.acl.gov/p-agid-ui-fn
    type: apiKey
    in: header
    name: Ocp-Apim-Subscription-Key
    provider_stack: Azure API Management
    realm: https://p-acl-apim.azure-api.net/p-agid-ui-fn
    documented: false
    self_service_signup: false
    evidence:
      request: POST https://sic.acl.gov/p-agid-ui-fn/GetDataSets with no key
      status: 401
      response_header: >-
        www-authenticate: AzureApiManagementKey
        realm="https://p-acl-apim.azure-api.net/p-agid-ui-fn",
        name="Ocp-Apim-Subscription-Key", type="header"
    note: >-
      The subscription key the AGID web app uses is compiled into its public
      JavaScript bundle and is therefore shipped to every browser that loads
      agid.acl.gov. Its value is deliberately NOT recorded in this repository.
      There is no published process by which a third party can obtain a key of
      their own, so this is a browser-embedded key rather than a developer
      credential.
  - id: eldercare-anonymous
    api: Eldercare Locator Content API
    host: ehc.acl.gov
    base: https://ehc.acl.gov/api
    type: none
    documented: false
    self_service_signup: false
    evidence:
      request: GET https://ehc.acl.gov/api/eldercareglobal with no credentials
      status: 200
      content_type: application/json; charset=utf-8
    note: >-
      Strapi 5 headless CMS. The eldercareglobal collection is readable
      anonymously; other Strapi collection names probed (pages, articles, topics,
      resources) return 404, so the public role exposes a narrow allowlist rather
      than the whole content model.
oauth2: false
openid_connect: false
mutual_tls: false
oauth_discovery:
  probed:
    - url: https://sic.acl.gov/.well-known/oauth-authorization-server
      status: 404
    - url: https://sic.acl.gov/.well-known/openid-configuration
      status: 404
    - url: https://acl.gov/.well-known/openid-configuration
      status: 404
docs: null
docs_note: No ACL authentication or developer-credential documentation was found on any ACL host.
maintainers:
  - FN: Kin Lane
    X-twitter: apievangelist
    email: info@apievangelist.com