generated: '2026-08-01'
method: probed
source: https://www.engrail.com/.well-known/oauth-authorization-server
docs: https://www.engrail.com/wp-json/
note: >-
  Upgraded from the mechanical OpenAPI derivation (which saw only the WordPress Application Password
  scheme) with the live RFC 8414 / RFC 9728 discovery documents served at the apex. Engrail runs two
  distinct auth models on one host: HTTP Basic Application Passwords for the WordPress REST content
  API, and a full OAuth 2.1 authorization-code + PKCE flow that exists solely to authorize its Model
  Context Protocol servers.
summary:
  types:
  - http
  - oauth2
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  anonymous_read: true
  anonymous_read_note: >-
    The 16 content operations in openapi/engrail-therapeutics-content-openapi.yml were each verified
    to return HTTP 200 without credentials on 2026-08-01.
schemes:
- name: applicationPassword
  type: http
  scheme: basic
  surface: content-api
  description: >-
    WordPress Application Passwords, advertised by the site's own REST index
    (authentication.application-passwords.endpoints.authorization). Required for write operations and
    non-public collections such as /wp/v2/users, which returns 401 anonymously.
  authorization_endpoint: https://www.engrail.com/wp-admin/authorize-application.php
  sources:
  - openapi/engrail-therapeutics-content-openapi.yml
  - https://www.engrail.com/wp-json/
- name: mcpOAuth
  type: oauth2
  surface: mcp
  description: >-
    OAuth 2.1 authorization server protecting the site's MCP endpoints. Public clients only —
    token_endpoint_auth_methods_supported is ["none"] — with PKCE S256 mandatory and client identity
    supplied by a client-id metadata document rather than pre-registration.
  issuer: https://www.engrail.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://www.engrail.com/oauth/authorize
    tokenUrl: https://www.engrail.com/oauth/token
    revocationUrl: https://www.engrail.com/oauth/revoke
    scopes:
      mcp: Access the site's Model Context Protocol servers.
  grant_types_supported:
  - authorization_code
  - refresh_token
  response_types_supported:
  - code
  code_challenge_methods_supported:
  - S256
  token_endpoint_auth_methods_supported:
  - none
  client_id_metadata_document_supported: true
  bearer_methods_supported:
  - header
  protected_resource: https://www.engrail.com/wp-json/mcp/mcp-oauth-server
  sources:
  - well-known/engrail-therapeutics-oauth-authorization-server.json
  - well-known/engrail-therapeutics-oauth-protected-resource.json
x-evidence:
  fetched: '2026-08-01'
  probes:
  - url: https://www.engrail.com/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json
  - url: https://www.engrail.com/.well-known/oauth-protected-resource
    http_status: 200
    content_type: application/json
  - url: https://www.engrail.com/wp-json/
    http_status: 200
    content_type: application/json
  - url: https://www.engrail.com/wp-json/wp/v2/users
    http_status: 401
    note: Anonymous read denied — confirms the gated half of the surface.