generated: '2026-08-04'
method: probed
source: https://grintherapeutics.com/wp-json/ (REST API index `authentication` block) plus live anonymous requests
note: >-
  The OpenAPI in this repo declares no securitySchemes because the operations it models are the ones
  that genuinely return data with no credentials — the read side of the WordPress REST content API is
  fully anonymous. This profile records that anonymous-read model and the authenticated surface that
  sits behind it, which the site's own REST index advertises. GRIN Therapeutics publishes no
  developer authentication documentation of its own; the scheme below is WordPress core behaviour.
summary:
  types: [none, http]
  anonymous_read: true
  api_key_in: []
  oauth2_flows: []
  oauth2: false
  openid_connect: false
schemes:
- name: anonymous
  type: none
  description: >-
    Every operation modelled in openapi/grin-therapeutics-content-openapi.yml was verified to return
    data with no Authorization header, no cookie and no nonce. Read access is unrestricted and
    unmetered as observed.
  applies_to:
  - getApiIndex
  - listPosts
  - getPost
  - listPages
  - getPage
  - listMedia
  - getMediaItem
  - listCategories
  - getCategory
  - listTags
  - getTag
  - listUsers
  - getUser
  - searchContent
  - listTypes
  - getType
  - listTaxonomies
  - listStatuses
  - getOembed
  sources: [openapi/grin-therapeutics-content-openapi.yml]
- name: application-passwords
  type: http
  scheme: basic
  description: >-
    WordPress Application Passwords (HTTP Basic with a per-application credential). Advertised
    verbatim by the site's own REST index at https://grintherapeutics.com/wp-json/ as
    authentication.application-passwords.endpoints.authorization =
    https://grintherapeutics.com/wp-admin/authorize-application.php. This gates the write surface and
    the privileged read surface; it is an internal editorial credential, not a developer credential —
    GRIN Therapeutics offers no way for a third party to obtain one.
  authorization_endpoint: https://grintherapeutics.com/wp-admin/authorize-application.php
  sources: [https://grintherapeutics.com/wp-json/]
- name: cookie-plus-nonce
  type: apiKey
  in: header
  parameter_name: X-WP-Nonce
  description: >-
    WordPress core's first-party session scheme for same-origin browser requests. Inferred from the
    Access-Control-Allow-Headers response header observed on the collection endpoints, which lists
    'Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type'. Not usable by a
    third-party integrator.
  sources: [https://grintherapeutics.com/wp-json/wp/v2/pages]
gated_surfaces:
- path: /wp/v2/settings
  status: 401
  code: rest_forbidden
- path: /wp/v2/users/me
  status: 401
  note: Requires an authenticated principal.
- path: /wp-abilities/v1/abilities
  status: 401
  code: rest_forbidden
  note: >-
    The WordPress Abilities API — an agent-facing capability registry with a /run execution
    endpoint — is registered on this site but is entirely credential-gated. No agent capability is
    exposed to anonymous callers, so no MCP or agent-surface claim is made for this provider.
- path: /wp-abilities/v1/categories
  status: 401
  code: rest_forbidden
- path: /contact-form-7/v1/contact-forms
  status: 403
  code: wpcf7_forbidden
- path: /wp/v2/comments
  status: 403
  code: rest_comment_disabled
  note: Comments are disabled site-wide, so the comments collection is unreadable rather than empty.