generated: '2026-08-09'
method: derived
source: openapi/centrexion-therapeutics-content-openapi.yml + live probes of https://centrexion.com/wp-json/
summary:
  types: []
  api_key_in: []
  oauth2_flows: []
  anonymous_read: true
note: >-
  The Centrexion Therapeutics content API declares NO security schemes for the operations catalogued
  in this repo, because every catalogued operation is anonymously readable. This is not an omission
  in the derivation — it is the actual posture of the surface. The site index at
  https://centrexion.com/wp-json/ advertises exactly one registered authentication method,
  WordPress application passwords, whose authorization endpoint is
  https://centrexion.com/wp-admin/authorize-application.php. That mechanism gates the write and
  administrative surface, which this repo deliberately does not model. There is no OAuth 2.0
  authorization server, no OpenID Connect discovery document, no API-key programme, no developer
  key issuance, and no scope model — /.well-known/oauth-authorization-server and
  /.well-known/openid-configuration both return 404 (see
  well-known/centrexion-therapeutics-well-known.yml). Consequently there is no scopes/ artifact for
  this provider: OAuth scopes require an OAuth surface, and none exists.
schemes:
- name: applicationPassword
  type: http
  scheme: basic
  description: >-
    WordPress application passwords, sent as HTTP Basic credentials. Advertised in the REST index
    `authentication` object. Governs write and administrative routes only; not required by, and not
    applicable to, any operation modelled in this repo.
  authorization_endpoint: https://centrexion.com/wp-admin/authorize-application.php
  applies_to: write and administrative routes (not modelled)
  sources: [https://centrexion.com/wp-json/]
anonymous_surface:
  description: >-
    Operations verified to return data with no credentials on 2026-08-09. These are the operations
    modelled in openapi/centrexion-therapeutics-content-openapi.yml.
  operations:
  - getApiIndex
  - listPosts
  - getPost
  - listPages
  - getPage
  - listMedia
  - getMediaItem
  - listCategories
  - getCategory
  - listTags
  - listPostSeries
  - listComments
  - getComment
  - search
  - listUsers
  - listNavigation
  - getNavigation
  - listReusableBlocks
  - listDynamicTemplates
  - listCustomCards
  - listPostTypes
  - getPostType
  - listTaxonomies
  - getTaxonomy
  - listStatuses
  - getStatus
  - getOembed
gated_surface:
  description: >-
    Routes that exist in the published route index but returned 401 to an anonymous caller on
    2026-08-09, with the WordPress error code each returned. Recorded so the boundary between the
    public and credentialed surface is explicit; none of these are modelled in the OpenAPI.
  routes:
  - {path: /wp/v2/settings, status: 401, code: rest_forbidden}
  - {path: /wp/v2/menus, status: 401, code: rest_cannot_view}
  - {path: /wp/v2/menu-locations, status: 401, code: rest_cannot_view}
  - {path: /wp/v2/icons, status: 401, code: rest_cannot_view}
  - {path: /wp/v2/block-patterns/categories, status: 401, code: rest_cannot_view}
  - {path: /wp/v2/themes, status: 401, code: rest_cannot_view_themes}
  - {path: /wp/v2/plugins, status: 401, code: rest_cannot_view_plugins}
  - {path: /wp/v2/block-types, status: 401, code: rest_block_type_cannot_view}
  - {path: /wp/v2/font-collections, status: 401, code: rest_cannot_read}
  - {path: /wp/v2/sidebars, status: 401, code: rest_cannot_manage_widgets}
  - {path: /wp/v2/widget-types, status: 401, code: rest_cannot_manage_widgets}
  - {path: /wp/v2/pattern-directory/patterns, status: 401, code: rest_pattern_directory_cannot_view}
  - {path: /wp-abilities/v1/abilities, status: 401, code: rest_forbidden}
  - {path: /wp-abilities/v1/categories, status: 401, code: rest_forbidden}