specification: API Commons Authentication
specificationVersion: '0.1'
provider: CenterPoint Energy
providerId: centerpoint-energy
api: centerpoint-energy:usage-history-inquiry
generated: '2026-09-05'
method: searched
source: https://www.smartmetertexas.com/commonapi/gethelpguide/help-guides/Smart_Meter_Texas_Interface_Guide.pdf
docs: https://www.smartmetertexas.com/commonapi/gethelpguide/help-guides/Smart_Meter_Texas_Interface_Guide.pdf
note: >-
  Read from section 2 (Security Integration Requirements) of the Smart Meter Texas 3.0 Data Access
  Interface Guide dated February 26, 2024, fetched at HTTP 200. Smart Meter Texas is jointly owned and
  funded by the four Texas TDSPs including CenterPoint Energy Houston Electric, and is the interface
  CenterPoint's competitive-retailer documentation directs third parties to for CenterPoint meter data;
  the auth scheme below is SMT's, and applies to every CenterPoint ESI ID reached through it. No
  OpenAPI securitySchemes block exists to derive from — SMT publishes no machine-readable contract.
description: >-
  Two-factor transport plus credential authentication. Every API call is made over mutual TLS with a
  signed, registered API SSL certificate whose domain name must match the requesting entity, and carries
  an HTTP Basic authorization header with an ID/password pair created by the entity account owner in the
  SMT 3.0 portal. Credentials are scoped per DUNS number; a service provider representing multiple
  entities needs a separate unique SSL certificate per entity. Wildcard certificates are rejected.
securitySchemes:
  - id: smt_mutual_tls
    type: mutualTLS
    description: >-
      Signed registered API SSL certificate required per SMT entity account. The production certificate's
      domain name must match the entity domain name; unsigned certificates are accepted for testing only;
      no wildcard certificates are accepted. Third-party service providers need one unique certificate per
      entity they represent.
    required: true
  - id: smt_http_basic
    type: http
    scheme: basic
    description: >-
      One set of API credentials (ID and password) per DUNS associated with an SMT account, created by the
      entity account owner in the SMT 3.0 portal. A missing header returns 403
      {"error":"Basic authentication header is missing."}; a wrong pair returns 401
      {"error":"Incorrect username or password."}.
    required: true
  - id: smt_requester_identity
    type: payloadField
    description: >-
      Beyond transport and credential auth, each request body carries requesterID, requesterType and
      requesterAuthenticationID fields identifying the acting entity, and data access for a given ESI ID
      is additionally gated by an executed Energy Data Sharing Agreement between the customer and the
      requesting party.
    required: true
transport:
  tls_versions_supported:
    - TLSv1.0
    - TLSv1.1
    - TLSv1.2
  mutual_tls: true
  note: >-
    The guide states only TLS 1.0-1.2 are supported for the integration channel and that mutual TLS
    authentication is required. TLS 1.0/1.1 are deprecated protocols; recorded here verbatim as published,
    not endorsed.
oauth2: false
api_keys: false
openid_connect: false
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com