generated: '2026-08-12'
method: probed
source: >-
  https://federatedwireless.ai/.well-known/oauth-authorization-server +
  https://federatedwireless.ai/.well-known/oauth-protected-resource + live probes of every Federated
  Wireless API host
docs: null
description: >-
  Federated Wireless publishes no OpenAPI or Swagger document on any host, so this profile could not
  be derived from securitySchemes. It was assembled entirely from live probes. There is exactly one
  publicly documented authentication mechanism — the OAuth 2.1 authorization server that fronts the
  MCP server on federatedwireless.ai. Every other Federated Wireless API surface is authenticated but
  undocumented: the three Spectrum Controller AWS API Gateway endpoints return 403
  MissingAuthenticationTokenException to anonymous callers without advertising a scheme, and the
  regulated SAS-CBSD and 6 GHz AFC interfaces are not reachable from the public internet at all.
summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  documented_publicly: false
  note: >-
    `types` lists only what is observable. It is a floor, not a complete picture — the product APIs
    certainly authenticate, but Federated Wireless publishes nothing that says how.
schemes:
- name: FederatedWirelessMCPOAuth
  type: oauth2
  source: https://federatedwireless.ai/.well-known/oauth-authorization-server
  applies_to: https://federatedwireless.ai/wp-json/mcp/mcp-oauth-server
  issuer: https://federatedwireless.ai
  flows:
  - flow: authorizationCode
    authorizationUrl: https://federatedwireless.ai/oauth/authorize
    tokenUrl: https://federatedwireless.ai/oauth/token
    revocationUrl: https://federatedwireless.ai/oauth/revoke
    scopes: [mcp]
    pkce: required (S256)
    public_client: true
  bearer_methods: [header]
  detail: scopes/federated-wireless-scopes.yml
undocumented_surfaces:
- surface: Spectrum Controller external SAS API
  base_url: https://spectrum-api.federatedwireless.com/v1
  observed: >-
    HTTP 403 {"message": "Missing Authentication Token"}; x-amzn-errortype
    MissingAuthenticationTokenException. AWS API Gateway
    (d-d3psb9cl3e.execute-api.us-west-2.amazonaws.com). No WWW-Authenticate header, so the scheme
    (IAM SigV4, Cognito authorizer, API key or custom Lambda authorizer) is not observable anonymously.
- surface: Spectrum IAM API
  base_url: https://spectrum-iam.federatedwireless.com/v1
  observed: HTTP 403 MissingAuthenticationTokenException. AWS API Gateway behind CloudFront.
  note: >-
    The name and the fact that the Spectrum Controller web app calls it as IAM_BASE_URL indicate this
    is the identity/session service for the customer portal, but no scheme is published.
- surface: Spectrum KPI / analytics + reporting API
  base_url: https://spectrum-kpi.federatedwireless.com/v2.0
  observed: HTTP 403 MissingAuthenticationTokenException. AWS API Gateway behind CloudFront.
- surface: SAS-CBSD interface
  base_url: https://sas.federatedwireless.com
  observed: TCP 443 refused from the public internet; DNS resolves to 35.166.171.66 (AWS us-west-2).
  expected_scheme: >-
    Mutual TLS with CBSD client certificates, per WInnForum WINNF-TS-0016 (SAS to CBSD Technical
    Specification) and FCC Part 96. Recorded as the regulated protocol's requirement, NOT as an
    observation — no handshake was completed.
- surface: 6 GHz AFC device interface
  base_url: https://afc.federatedwireless.com
  observed: >-
    TCP 443 refused from the public internet; DNS resolves to an AWS ELB
    (a98859f24fc724909b8a256a877bbb50-431290955.us-west-2.elb.amazonaws.com).
  expected_scheme: >-
    Certified-device / proxy authentication per the WInnForum AFC System to AFC Device interface.
    Recorded as the protocol's requirement, not as an observation.
- surface: MyFederated customer portal
  base_url: https://myfederated.federatedwireless.com
  observed: >-
    Zendesk-hosted (federatedwirelessinc.zendesk.com). /hc/en-us returns 403 to an anonymous visitor;
    only the Help Center REST API is open, and it exposes six FAQ articles about course access and
    password resets. Sign-in required for everything else.
x-evidence:
  fetched: '2026-08-12'
  probes:
  - url: https://federatedwireless.ai/.well-known/oauth-authorization-server
    status: 200
  - url: https://federatedwireless.ai/wp-json/mcp/mcp-oauth-server
    status: 401
  - url: https://spectrum-api.federatedwireless.com/v1
    status: 403
  - url: https://spectrum-iam.federatedwireless.com/v1
    status: 403
  - url: https://spectrum-kpi.federatedwireless.com/v1
    status: 403
  - url: https://myfederated.federatedwireless.com/hc/en-us
    status: 403