generated: '2026-08-12'
method: probed
source: https://energyx.com/wp-json/
docs: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
description: >-
  EnergyX publishes no developer program and issues no API credentials. The WordPress REST content
  API behind energyx.com is anonymously readable — no key, token, signature or account is required
  to read posts, pages, press releases, in-the-news coverage, leadership, job positions, partners,
  videos, resource guides, media, taxonomies, search, the storefront catalog or the discovery
  metadata. The server declares exactly one authentication method in its own root document,
  WordPress application passwords, and that method gates only the write and privileged-read
  operations that are not part of the public surface.
summary:
  types: []
  anonymous_read: true
  credentialed_write: true
  api_key_in: []
  oauth2_flows: []
  note: >-
    No securityScheme appears in any of the fifteen derived OpenAPI documents because the public
    surface genuinely has none. This is a recorded absence, not a gap in harvesting. Running
    0-working/derive-authentication.py against this repo returns zero schemes for the same reason.
schemes: []
declared_by_server:
- name: application-passwords
  type: http
  scheme: basic
  description: >-
    WordPress application passwords (RFC 7617 Basic over TLS, username + generated application
    password). Declared in the `authentication` block of the API root document. Required for every
    write method and for privileged reads such as GET /wp/v2/settings. Credentials are issued per
    WordPress user from the site admin — there is no public registration path, so this is a
    staff-only credential, not a developer credential.
  authorization_endpoint: https://energyx.com/wp/wp-admin/authorize-application.php
  source: https://energyx.com/wp-json/
adjacent_gated_surface:
- namespace: wc/v3
  description: >-
    The WooCommerce admin REST API is registered on the same host and would normally be reached
    with a consumer key/secret pair. It returns 401 to an anonymous caller and there is no public
    key issuance path, so it is out of scope and is deliberately not modelled in openapi/.
  observed_status: 401
evidence:
- url: https://energyx.com/wp-json/
  http_status: 200
  finding: 'authentication: {"application-passwords": {"endpoints": {"authorization": "https://energyx.com/wp/wp-admin/authorize-application.php"}}}'
- url: https://energyx.com/wp-json/wp/v2/posts?per_page=2
  http_status: 200
  finding: 'Anonymous read succeeds; response carries `Allow: GET`, confirming read-only anonymous access. X-WP-Total 69.'
- url: https://energyx.com/wp-json/wp/v2/enx-press-release?per_page=1
  http_status: 200
  finding: Anonymous read of the site-specific press-release post type succeeds, X-WP-Total 39.
- url: https://energyx.com/wp-json/wc/store/v1/products?per_page=1
  http_status: 200
  finding: Anonymous read of the WooCommerce Store API storefront catalog succeeds, X-WP-Total 15.
- url: https://energyx.com/wp-json/wc/v3/products?per_page=1
  http_status: 401
  finding: WooCommerce admin API rejects the anonymous caller; no public credential path exists.
- url: https://energyx.com/wp-json/wp/v2/settings
  http_status: 401
  finding: '{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}'
x-evidence:
  fetched: '2026-08-12'
  probes: 6