generated: '2026-08-04' method: derived source: live anonymous probes of https://cresilon.com/wp-json/ (2026-08-04) summary: types: - none - cookie - basic api_key_in: [] oauth2_flows: [] notes: >- Cresilon is a biotechnology and medical-device manufacturer. It publishes no developer program, no API documentation and no product API. Its only machine-readable surface is the platform-provided WordPress REST API at /wp-json/, and the read half of that surface is fully public: every operation documented in this repo's openapi/ specs was verified to return HTTP 200 with JSON to an anonymous request carrying no credentials of any kind. There is no API key, no OAuth, no developer signup, and no rate-limit or quota signalling observed. Unlike most WordPress deployments in this catalog, the root index DOES advertise an authentication method — WordPress Application Passwords, with an authorization endpoint at https://cresilon.com/wp-admin/authorize-application.php. That is an administrative credential for a site user, not a public developer credential, and the pipeline did not and will not attempt to obtain one. Write operations (POST/PUT/PATCH/DELETE) are registered on the same routes but reject anonymous callers with HTTP 401; they require a logged-in WordPress session cookie plus an X-WP-Nonce header, or an Application Password over HTTP Basic. Those write operations are deliberately NOT documented in the openapi/ specs, which describe only the anonymously reachable read surface. schemes: - name: public-read type: none description: >- Anonymous public read access to the WordPress content API — posts, pages, media, categories, tags, comments, authors, search, oEmbed, the Yoast SEO head endpoint, and the type/taxonomy/status registries. evidence: >- GET /wp-json/wp/v2/posts?per_page=1 returned 200 with post JSON and X-WP-Total: 36; the same anonymous request pattern returned 200 on pages (53), media (1307), categories (2), tags (4), users (1), comments (0), search, types, taxonomies, statuses, oembed/1.0/embed and yoast/v1/get_head. - name: wordpress-cookie-nonce type: cookie in: cookie description: >- WordPress core cookie authentication paired with an X-WP-Nonce request header, required for the write half of the same routes and for the administrative read routes. Not a public developer credential — it belongs to a logged-in site user. evidence: >- Access-Control-Allow-Headers on /wp-json/wp/v2/posts advertises `Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type`. - name: application-passwords type: http scheme: basic description: >- WordPress Application Passwords over HTTP Basic. This is the ONLY authentication method the site advertises in its REST root index, and it is an administrative credential issued to an existing WordPress user — there is no self-service developer signup behind it. authorization_endpoint: https://cresilon.com/wp-admin/authorize-application.php evidence: >- The root index at https://cresilon.com/wp-json/ returns `"authentication": {"application-passwords": {"endpoints": {"authorization": "https://cresilon.com/wp-admin/authorize-application.php"}}}`. public_credential: false site_member_area: description: >- Separate from the REST surface, cresilon.com runs a human-facing member area (WordPress Download Manager) gating TRAUMAGEL and VETIGEL resource downloads. It is a web login, not an API credential, and no REST route exposes it anonymously. register: https://cresilon.com/register/ login: https://cresilon.com/login/ account: https://cresilon.com/account/ distributor_portal: url: https://cresilon.com/distributor-portal/ gate: WordPress page password (verified live — the page renders a single password prompt) evidence: >- GET /register/ returned 200 with a real registration form (10 inputs); GET /login/ returned 200 with a real login form; GET /distributor-portal/ returned 200 with "This content is password-protected." gated_surface: description: >- Routes present in the live route table but NOT anonymously readable. Recorded so the public/private split of this surface is explicit rather than inferred. routes: - path: /wp/v2/settings status: 401 code: rest_forbidden - path: /wp/v2/themes status: 401 code: rest_cannot_view_themes - path: /wp/v2/plugins status: 401 code: rest_cannot_view_plugins - path: /wp/v2/menus status: 401 code: rest_cannot_view - path: /wp/v2/menu-items status: 401 code: rest_cannot_view - path: /wp/v2/block-types status: 401 code: rest_block_type_cannot_view - path: /wp/v2/templates status: 401 code: rest_cannot_manage_templates - path: /wp/v2/template-parts status: 401 code: rest_cannot_manage_templates - path: /wp/v2/pattern-directory/patterns status: 401 code: rest_pattern_directory_cannot_view - path: /wp/v2/font-families status: 401 code: rest_cannot_read - path: /wp/v2/posts/{id}/revisions status: 401 code: rest_cannot_read - path: /oembed/1.0/proxy status: 401 code: rest_forbidden - path: /jetpack/v4/site status: 401 code: invalid_user_permission_view_admin - path: /wp-abilities/v1/abilities status: 401 code: rest_forbidden - path: /wp-site-health/v1/tests/background-updates status: 401 notable_difference_from_catalog_norm: >- On most WordPress sites in this catalog /wp/v2/users returns 401 (rest_user_cannot_view). On cresilon.com it returns 200 with a single author record (id 211412379, slug `cresilon`), so the numeric `author` field on every post IS publicly resolvable here. docs: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ x-evidence: fetched: '2026-08-04' host: https://cresilon.com root_index: https://cresilon.com/wp-json/ namespaces: 45 routes_advertised: 1021 authentication_field: application-passwords: endpoints: authorization: https://cresilon.com/wp-admin/authorize-application.php