generated: '2026-07-25'
method: searched
source: >-
  Live probes of api.definity.com, www.definityfinancial.com, www.economical.com,
  www.sonnet.ca and broker.economical.com, plus CSIO's certification register
published: false
summary:
  types: []
  api_key_in: []
  oauth2_flows: []
  note: >-
    Definity Financial publishes no authentication documentation and no machine-readable
    security scheme. There is no OpenAPI, so there is nothing to derive from. This file is
    an honest posture record, not a derived scheme list.
schemes: []
posture:
  audience: partner-only
  self_serve_signup: false
  public_credentials: false
  gateway:
    host: api.definity.com
    reachable: true
    documented: false
    note: >-
      Resolves behind an Imperva edge (45.60.75.50, 45.60.135.50) and answers HTTP 404 with
      content-length 0 to every anonymous path, including /.well-known/openid-configuration
      and /.well-known/oauth-authorization-server. A production/partner gateway with zero
      public discovery surface.
  broker_channel:
    host: broker.economical.com
    reachable: true
    documented: false
    note: >-
      Docebo SaaS learning management system (CNAME economical.docebosaas.com) serving broker
      training courseware behind a sign-in wall. A login wall, not a developer portal and not
      an authorization server.
  consumer_channel:
    host: www.sonnet.ca
    login: https://www.sonnet.ca/account-log-in
    note: Policyholder web account for the direct-to-consumer Sonnet brand. Not an API credential surface.
attested_model:
  standard: CSIO API Security Standards
  certified: true
  certified_on: '2024-11-27'
  body: Centre for Study of Insurance Operations (CSIO)
  description: >-
    Although Definity documents no authentication scheme publicly, it IS certified against
    CSIO's API Security Standards, which define a standard authentication and authorization
    API model for insurer-to-Broker-Management-System connectivity. The Standards were
    produced by CSIO's INNOTECH Advisory Committee and its API Security Working Group, address
    OAuth 2.1 security concerns, and require certified members to confirm prevention of 16
    OAuth security concerns and 18 API endpoint concerns. This is third-party attestation of
    an OAuth-family model on the gated broker channel — it is NOT a first-party contract, and
    the specific grant types, token endpoints and scopes remain unpublished.
  sources:
  - https://csio.com/news/csio-congratulates-definity-financial-corporation-achieving-api-security-standards
  - https://csio.com/csio-certification/certified-members
probes:
- url: https://api.definity.com/.well-known/openid-configuration
  status: 404
- url: https://api.definity.com/.well-known/oauth-authorization-server
  status: 404
- url: https://api.definity.com/.well-known/oauth-protected-resource
  status: 404
- url: https://www.sonnet.ca/.well-known/openid-configuration
  status: 404
- url: https://www.definityfinancial.com/.well-known/openid-configuration
  status: 200
  note: Body is the eleven-byte string "Invalid key" — not OpenID Provider metadata.