generated: '2026-09-02' method: probed source: >- https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration (probed) and https://www.ameren.com/partners/account-and-data/share-my-usage (searched) provider: Ameren providerId: ameren description: >- Cross-cutting and domain standard conformance for Ameren. There is no OpenAPI to read, so every assertion below is anchored either in the live OIDC discovery document Ameren's identity service serves or in Ameren Illinois' own program documentation. Nothing here is inferred from category. standards: - id: oauth2 name: OAuth 2.0 (RFC 6749) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: grant_types_supported, authorization_endpoint, token_endpoint detail: >- authorization_code, client_credentials, refresh_token, password, implicit and device_code grants advertised with authorize and access_token endpoints. - id: oidc name: OpenID Connect Core 1.0 + Discovery 1.0 conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: issuer, jwks_uri, userinfo_endpoint, id_token_signing_alg_values_supported detail: >- A complete OIDC discovery document is served anonymously. Note it is at the ForgeRock AM path /am/oauth2/.well-known/openid-configuration; the RFC 8414 root path 404s, so an out-of-the-box RFC 8414 client will not find it. - id: rfc7636-pkce name: PKCE (RFC 7636) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: code_challenge_methods_supported detail: 'S256 and plain both advertised.' - id: rfc9126-par name: Pushed Authorization Requests (RFC 9126) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: pushed_authorization_request_endpoint, require_pushed_authorization_requests detail: PAR endpoint advertised; not required. - id: rfc7009-revocation name: OAuth 2.0 Token Revocation (RFC 7009) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: revocation_endpoint - id: rfc7662-introspection name: OAuth 2.0 Token Introspection (RFC 7662) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: introspection_endpoint - id: rfc7591-dcr name: OAuth 2.0 Dynamic Client Registration (RFC 7591) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: registration_endpoint - id: rfc8628-device-flow name: OAuth 2.0 Device Authorization Grant (RFC 8628) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: grant_types_supported detail: 'urn:ietf:params:oauth:grant-type:device_code advertised.' - id: rfc8705-mtls name: OAuth 2.0 Mutual-TLS Client Authentication (RFC 8705) conforms: partial evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: token_endpoint_auth_methods_supported, tls_client_certificate_bound_access_tokens detail: >- tls_client_auth and self_signed_tls_client_auth advertised, but tls_client_certificate_bound_access_tokens is false — mTLS client authentication without certificate-bound tokens. - id: jarm name: JWT Secured Authorization Response Mode (JARM) conforms: true evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration location: response_modes_supported detail: 'query.jwt, fragment.jwt, form_post.jwt and jwt advertised.' - id: rfc9116-security-txt name: security.txt (RFC 9116) conforms: partial evidence: source: https://www.ameren.com/-/media/security.txt location: Contact, Expires, Encryption, Preferred-Languages detail: >- A valid RFC 9116 file is served on www, anm and gp, but its Expires value (2026-08-09T07:01:00.000Z) is in the past as of 2026-09-02, and on www the /.well-known/ path is a 302 rather than serving the file directly. RFC 9116 says a file past its Expires date should not be relied upon. - id: rfc9457-problem-details name: Problem Details for HTTP APIs (RFC 9457) conforms: unknown evidence: detail: >- No public API surface and no error reference published, so this cannot be determined either way. Not asserted. - id: fapi name: FAPI 1.0 / 2.0 conforms: false evidence: source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration detail: >- No FAPI conformance is claimed and the configuration would not meet it — the implicit and password grants are still enabled, PAR is optional, and access tokens are not certificate-bound. Recorded as a negative finding, not a penalty. - id: rfc8414 name: OAuth 2.0 Authorization Server Metadata (RFC 8414) conforms: partial evidence: source: https://login.eiam.ece.ameren.com/.well-known/oauth-authorization-server detail: >- 404 at the RFC 8414 path. The equivalent metadata is only reachable at the vendor-prefixed /am/oauth2/.well-known/openid-configuration path. domain_standards: - id: espi-green-button name: NAESB Energy Services Provider Interface (ESPI) / Green Button Connect My Data market: Regulated electric utility customer energy usage data conforms: true declared_in: documentation contract_declared: false evidence: source: https://www.ameren.com/partners/account-and-data/share-my-usage status: 200 detail: >- Ameren Illinois states the program is "based on the common technical standards developed with the support of the Commerce Department's National Institute of Standards and Technology (NIST), released by the North American Energy Standards Board (NAESB)", that ESPI "consists of a common XML format for energy usage information and a data exchange protocol", and that its technical requirements are "consistent with those defined in the standard Green Button Connect Application Programming Interfaces (API)". caveat: >- REWARD-ONLY AND HONESTLY QUALIFIED: this is a prose claim on a program page, not a standard declared inside a machine-readable contract. Ameren publishes no ESPI ApplicationInformation resource, no Atom/XML schema and no endpoint list publicly. The canonical Green Button DataCustodian resource path was probed on gp.ameren.com and returned the site's HTML bot-challenge page. A third party learns the actual ESPI surface from Aclara during registration. - id: green-button-alliance-certification name: Green Button Alliance certification conforms: unknown evidence: detail: >- Ameren Illinois participates in the Green Button initiative, but no Green Button Alliance certification mark or certificate number was found on any Ameren page. Not asserted. compliance_certifications: [] compliance_note: >- No trust center, SOC 2, ISO 27001, PCI, HIPAA or FedRAMP certification page was found on ameren.com. probe-security-programs.py returned trust=none. As a regulated utility Ameren is subject to NERC CIP, but nothing is published as a customer-facing compliance program, so no Compliance pointer is emitted. maintainers: - FN: Kin Lane email: kin@apievangelist.com