generated: '2026-08-17'
method: probed
source: >-
  Anonymous probes of https://ocpi.go-electra.com/ocpi/cpo/* on 2026-08-17
  (response headers and bodies), plus /.well-known/openid-configuration,
  /.well-known/oauth-authorization-server and
  /.well-known/oauth-protected-resource on go-electra.com, app.go-electra.com,
  backend.go-electra.com and ocpi.go-electra.com.
description: >-
  Electra has no OpenAPI, so this profile is not derived from securitySchemes —
  it is what the live surface actually answered. The single authenticated API
  Electra runs is its OCPI Charge Point Operator interface, and it uses OCPI's
  own bilateral Token scheme. There is no OAuth 2, no OpenID Connect, no
  self-service API key, no developer signup and no sandbox credential anywhere
  in Electra's public surface.
summary:
  types: [ocpi-token]
  api_key_in: [header]
  oauth2_flows: []
  self_service: false
  note: >-
    OCPI Token is an HTTP Authorization scheme with the literal auth-scheme name
    `Token` (Authorization: Token <credential>), exchanged bilaterally through
    the OCPI credentials module after a commercial roaming agreement. It is not
    an apiKey, http-bearer, oauth2 or openIdConnect scheme in OpenAPI terms,
    which is why no standard securityScheme name is asserted here.
schemes:
- name: OCPI Token
  type: http
  scheme: Token
  in: header
  parameter: Authorization
  realm: Application
  applies_to: >-
    Every OCPI module endpoint under https://ocpi.go-electra.com/ocpi/cpo/2.1.1
    and /2.2.1 (cdrs, commands, locations, sessions, tariffs, tokens).
  onboarding: >-
    Bilateral. A roaming partner and Electra exchange OCPI credentials tokens
    through the credentials module; no public registration flow exists.
  evidence:
  - url: https://ocpi.go-electra.com/ocpi/cpo/2.2.1/locations
    http_status: 401
    response_header: 'WWW-Authenticate: Token realm="Application"'
    body: 'Token: Access denied.'
    fetched: '2026-08-17'
  - url: https://ocpi.go-electra.com/ocpi/cpo/2.1.1/locations
    http_status: 401
    response_header: 'WWW-Authenticate: Token realm="Application"'
    body: 'Token: Access denied.'
    fetched: '2026-08-17'
  - url: https://ocpi.go-electra.com/ocpi/cpo/2.2.1/tariffs
    http_status: 401
    response_header: 'WWW-Authenticate: Token realm="Application"'
    body: 'Token: Access denied.'
    fetched: '2026-08-17'
unauthenticated_surface:
- url: https://ocpi.go-electra.com/ocpi/cpo/versions
  http_status: 200
  note: Version negotiation is deliberately open — no token required.
- url: https://ocpi.go-electra.com/ocpi/cpo/2.1.1
  http_status: 200
  note: Version-detail endpoint inventory is open.
- url: https://ocpi.go-electra.com/ocpi/cpo/2.2.1
  http_status: 200
  note: Version-detail endpoint inventory is open.
absent:
- scheme: oauth2
  evidence: >-
    /.well-known/oauth-authorization-server and
    /.well-known/oauth-protected-resource returned 404 on go-electra.com,
    backend.go-electra.com and ocpi.go-electra.com, and an HTML SPA shell (not a
    document) on app.go-electra.com. No OAuth is documented anywhere.
- scheme: openIdConnect
  evidence: >-
    /.well-known/openid-configuration returned 404 on go-electra.com,
    backend.go-electra.com and ocpi.go-electra.com; app.go-electra.com answers
    200 with the same HTML SPA shell it serves for every path, which is not a
    discovery document.
- scheme: apiKey
  evidence: >-
    No developer portal, no key-issuance page and no API documentation exist on
    any Electra host; the only key-shaped credential Electra publishes is a
    consumer promo code.