specification: API Commons Authentication
specificationVersion: '0.1'
provider: Cheniere Energy
providerId: cheniere-energy
generated: '2026-09-06'
method: probed
source: >-
  Anonymous GET requests to https://lngconnectionapi.cheniere.com on 2026-09-06, plus the
  provider's own client bundle (https://lngconnection.cheniere.com/app.c8746b4fbffdfedeb14b.js),
  which attaches no Authorization header, no API key and no token acquisition step to any request.
summary: >-
  The Cheniere LNG Connection informational-postings API requires no authentication of any kind.
  Nine of eleven read endpoints probed anonymously returned HTTP 200 with real posting data; the
  two failures were server-side 500s, not auth challenges. This is expected and correct: FERC
  18 CFR 284.13 requires an interstate pipeline to make these postings publicly available without
  a subscription or a registration barrier.
schemes: []
security_requirements: []
findings:
  - id: no-auth-required
    detail: >-
      No securityScheme is declared and none is enforced. There is no signup, no API key, no
      OAuth flow and no OpenID Connect discovery document on any Cheniere host.
    evidence:
      - url: https://lngconnectionapi.cheniere.com/api/Page/GetPages
        status: 200
        note: Anonymous request, no headers beyond a User-Agent. Returned the full page tree and TSP list.
      - url: https://lngconnectionapi.cheniere.com/api/Transactional/GetFirm?tspNo=200&beginDate=2026-09-01&endDate=2026-09-05
        status: 200
        note: Anonymous request returned contract-level transactional reporting rows.
  - id: session-cookie-issued-not-required
    detail: >-
      Every response sets an HttpOnly, Secure `LNGConnection` cookie. It is a load-balancer affinity
      cookie, not a credential — requests sent without it succeed identically.
    evidence:
      - url: https://lngconnectionapi.cheniere.com/api/Capacity/GetCycles
        status: 200
  - id: cors-single-origin
    detail: >-
      The API answers a CORS preflight with `Access-Control-Allow-Origin: https://lngconnection.cheniere.com`
      only. Browser code on any other origin is blocked, while server-side and agent callers are not
      affected. Worth knowing before planning a browser integration.
    evidence:
      - url: https://lngconnectionapi.cheniere.com/api/Capacity/GetCycles
        status: 200
        note: OPTIONS preflight with Origin https://lngconnection.cheniere.com returned 200 with a single-origin ACAO header.
  - id: no-auth-documentation
    detail: >-
      Cheniere publishes no developer documentation for this API, so there is no authentication page
      to cite. The absence of auth is established by probe, not by a provider statement.
    evidence:
      - url: https://lngconnectionapi.cheniere.com/swagger/v1/swagger.json
        status: 404
transport:
  https_required: true
  tls_version_observed: TLSv1.3
  server: Microsoft-IIS/10.0 (ASP.NET Web API 4.0.30319)