specification: API Commons Authentication
specificationVersion: '0.1'
provider: Campbell's
providerId: campbells
generated: '2026-09-05'
method: probed
source: >-
  Live probes of https://www.campbells.com/wp-json/ and reading of the
  provider-served route descriptor in discovery/campbells-wp-v2-routes.json,
  2026-09-05. Campbell's publishes no authentication documentation.
description: >-
  The Campbell's read surface requires no authentication at all: every content
  and search endpoint returned 200 anonymously. There is no API key, no OAuth,
  no signup and no developer account — which means there is also no way for an
  outside developer to authenticate into the routes that do require a
  credential.
summary:
  public_read: true
  credential_obtainable_by_developers: false
  signup_url: null
  key_prefixes: []
schemes:
  - id: none
    type: none
    applies_to: >-
      All read routes exercised — /wp/v2/recipe, /wp/v2/product, /wp/v2/csc_faq,
      /wp/v2/external_product, every csc_* taxonomy, /wp/v2/types,
      /yrsc-search/v1/query, /yrsc-search/v1/autocomplete,
      /yrsc-search/v1/featured-collections.
    evidence: >-
      GET https://www.campbells.com/wp-json/wp/v2/recipe?per_page=1 returned 200
      with no Authorization header.
  - id: wordpress-cookie-nonce
    type: cookie
    header: X-WP-Nonce
    applies_to: Browser-session writes from the site's own front end.
    evidence: >-
      access-control-allow-headers on the OPTIONS preflight names
      "Authorization, X-WP-Nonce, Content-Disposition, Content-MD5,
      Content-Type", and access-control-allow-credentials is true.
    obtainable: false
    note: Issued to a logged-in WordPress session only.
  - id: wordpress-application-passwords
    type: http
    scheme: basic
    applies_to: Programmatic writes as a WordPress user.
    evidence: >-
      The route descriptor registers
      /wp/v2/users/(?P<user_id>(?:[\d]+|me))/application-passwords and its
      /introspect sibling.
    obtainable: false
    note: >-
      Requires an existing WordPress user account on campbells.com. Recorded
      because the platform registers it, not because Campbell's offers it.
denied_anonymously:
  - route: /wp/v2/settings
    http_status: 401
    code: rest_forbidden
  - route: /wp/v2/plugins
    http_status: 401
    code: rest_cannot_view_plugins
oauth:
  supported: false
  detail: >-
    No oauth2 or openIdConnect scheme is registered. /.well-known/openid-configuration
    and /.well-known/oauth-authorization-server both 404 on every host — see
    well-known/campbells-well-known.yml. No scopes/ artifact is emitted, because
    there is no scope surface to describe.
mtls:
  supported: false
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com