generated: '2026-08-27'
method: probed
source: >-
  https://www.bloomberg.com/.well-known/openid-configuration,
  https://www.bloomberg.com/.well-known/oauth-authorization-server,
  https://login.bloomberg.com/api/oauth/.well-known/jwks.json, and the live 401/403
  envelopes returned by https://api.bloomberg.com/eap/ and /eap/catalogs/.
docs: https://professional.bloomberg.com/support/api-library/
description: >-
  Bloomberg has no published OpenAPI, so this profile was NOT derived from a spec - it
  was read from the two machine-readable authorization-server metadata documents
  Bloomberg serves at www.bloomberg.com and login.bloomberg.com, and from the
  authentication challenge the Data License API itself returns to an anonymous client.
summary:
  types:
    - oauth2
    - openIdConnect
    - http
  api_key_in: []
  oauth2_flows:
    - authorizationCode
  http_schemes:
    - bearer
  pkce_required_methods:
    - S256
schemes:
  - name: BloombergOIDC
    type: openIdConnect
    openIdConnectUrl: https://www.bloomberg.com/.well-known/openid-configuration
    issuer: https://www.bloomberg.com
    authorization_endpoint: https://login.bloomberg.com/api/oauth/authorize
    token_endpoint: https://login.bloomberg.com/api/oauth/token
    jwks_uri: https://login.bloomberg.com/api/oauth/.well-known/jwks.json
    response_types_supported:
      - code
    grant_types_supported:
      - authorization_code
      - refresh_token
    subject_types_supported:
      - public
    id_token_signing_alg_values_supported:
      - RS256
    code_challenge_methods_supported:
      - S256
    scopes_supported:
      - openid
      - user
      - entitlements
    sources:
      - well-known/bloomberg-data-sets-openid-configuration.json
  - name: BloombergOAuth2
    type: oauth2
    flows:
      - flow: authorizationCode
        authorizationUrl: https://login.bloomberg.com/api/oauth/authorize
        tokenUrl: https://login.bloomberg.com/api/oauth/token
        pkce: S256
        scopes:
          - openid
          - user
          - entitlements
    rfc: RFC 8414 authorization server metadata
    sources:
      - well-known/bloomberg-data-sets-oauth-authorization-server.json
  - name: DataLicenseJWT
    type: http
    scheme: bearer
    bearerFormat: JWT
    applies_to: https://api.bloomberg.com/eap
    evidence: >-
      GET https://api.bloomberg.com/eap/catalogs/ returns HTTP 401 with
      {"error":"unauthorized_client","error_description":"No definition of jwt found in
      header or query string."} and the response advertises
      Access-Control-Allow-Origin: https://console.bloomberg.com. The JWT is issued
      against Data License credentials provisioned through the Bloomberg Enterprise
      Console, not through the public OIDC flow above.
    note: >-
      The token acquisition procedure for Data License / HAPI is documented only behind
      the Enterprise Console; it was NOT read, and nothing about its shape is asserted
      here beyond the header requirement the API itself states.
observed_challenges:
  - url: https://api.bloomberg.com/eap/
    status: 401
    error: unauthorized_client
    detail: No definition of jwt found in header or query string.
  - url: https://api.bloomberg.com/eap/catalogs/
    status: 401
    error: unauthorized_client
    detail: No definition of jwt found in header or query string.
  - url: https://api.bloomberg.com/
    status: 403
    error: access_denied
    detail: Access forbidden.
non_http_authentication:
  - name: BLPAPI session authorization
    note: >-
      The Bloomberg Open API (BLPAPI) is not an HTTP API. Desktop API authorizes against
      a logged-in Bloomberg Terminal on the local machine; Server API and B-PIPE
      authorize sessions with an application name / identity token exchanged over the
      BLPAPI wire protocol. There is no bearer header and no OAuth surface on that path.
      Recorded for completeness; no HTTP security scheme is claimed for it.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com