generated: '2026-08-02'
method: searched
source: openapi/ascend-elements-wordpress-rest-openapi.yml
docs: https://ascendelements.com/wp-json/
x-evidence:
  fetched: '2026-08-02'
  application_passwords: >-
    advertised at https://ascendelements.com/wp-json/ under authentication.application-passwords
    (HTTP 200); authorize endpoint
    https://ascendelements.com/wp-admin/authorize-application.php
  oauth2: >-
    none. /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource
    return the host's 503 bot-protection HTML shell, not RFC 8414 / RFC 9728 metadata, and no
    OAuth namespace is registered in the route index. Unlike some WordPress deployments in this
    catalog, this site publishes no OAuth authorization server.
  cors_allowed_auth_headers:
  - Authorization
  - X-WP-Nonce
  observed_401s:
  - {url: 'https://ascendelements.com/wp-json/wp-abilities/v1/abilities', code: rest_forbidden, status: 401}
  - {url: 'https://ascendelements.com/wp-json/wp-abilities/v1/categories', code: rest_forbidden, status: 401}
  - {url: 'https://ascendelements.com/wp-json/wp/v2/menus', code: rest_cannot_view, status: 401}
  - {url: 'https://ascendelements.com/wp-json/wp/v2/menu-items', code: rest_cannot_view, status: 401}
  anonymous_read: >-
    the wp/v2 published-content collections read without credentials (HTTP 200): posts, pages,
    media, categories, tags, users, comments, search, types, taxonomies, statuses, and the
    company-specific job, job_category, job_location, media_coverage and sourcing-events
    collections
  anonymous_write: >-
    not permitted. The `Allow` response header on GET/OPTIONS of
    https://ascendelements.com/wp-json/wp/v2/posts is `GET` only for an unauthenticated
    caller, even though the route index advertises POST on that route for authenticated ones.
summary:
  types:
  - http
  api_key_in: []
  oauth2_flows: []
schemes:
- name: applicationPassword
  type: http
  scheme: basic
  description: >-
    WordPress Application Passwords, advertised by the route index at
    https://ascendelements.com/wp-json/ under authentication.application-passwords. A site
    administrator issues a per-application password at
    https://ascendelements.com/wp-admin/authorize-application.php and the client presents it
    as HTTP Basic (username + application password) on the Authorization header. This is the
    only programmatic credential the host advertises.
  sources:
  - openapi/ascend-elements-wordpress-rest-openapi.yml
- name: cookieNonce
  type: apiKey
  in: header
  parameter_name: X-WP-Nonce
  description: >-
    WordPress cookie authentication paired with a nonce on the X-WP-Nonce header — the
    first-party, same-origin scheme used by the site's own admin/editor JavaScript. Advertised
    indirectly via the access-control-allow-headers response header
    (`Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type`). Not usable
    by third-party server-side clients.
  sources:
  - openapi/ascend-elements-wordpress-rest-openapi.yml
notes: >-
  Ascend Elements publishes no developer API programme, so there is no signup, no API key
  issuance flow and no developer portal. Everything above is the stock WordPress
  authentication surface of the corporate website, verified live. No OAuthScopes artifact is
  emitted for this provider: there is no OAuth surface, and per the enrichment contract
  scopes/ is OAuth-only rather than a forced empty file.