generated: '2026-07-28'
method: searched
source: >-
  https://developer.heathrow.com/how-it-works, https://developer.heathrow.com/signin,
  https://developer.heathrow.com/config.json, and live probes of
  https://api.heathrow.com/ and https://apimgmt.lhr.aero/ on 2026-07-28.
docs: https://developer.heathrow.com/how-it-works
description: >-
  Heathrow runs a two-layer authentication model, and both layers are closed to
  anonymous callers. Human access to the developer portal is federated to
  Microsoft Entra ID (Azure Active Directory) and only issued after a manual
  enrolment conversation with Heathrow. Machine access to the runtime gateway at
  api.heathrow.com is gated by mutual TLS - the Azure Application Gateway
  terminates every anonymous request with "400 No required SSL certificate was
  sent" before routing, so a client certificate issued by Heathrow is a
  precondition to reaching any operation. No OpenAPI is published, so no
  securityScheme could be derived; this profile is taken from the provider's own
  public prose plus observed gateway behaviour.
summary:
  types: [mutualTLS, federated-sso]
  api_key_in: []
  oauth2_flows: []
  derived_from_openapi: false
  anonymous_access: false
  self_service_credentials: false
schemes:
  - name: microsoft-entra-id
    type: openIdConnect
    layer: developer-portal (human)
    provider: Microsoft Entra ID (Azure Active Directory)
    discovery_document: null
    evidence: >-
      https://developer.heathrow.com/signin - "Sign in using your Azure Active
      Directory credentials." No local-account option is offered. The portal is
      Azure API Management (config.json names the APIM instance
      apim-halcomcommon-prod-westeu-001 behind https://apimgmt.lhr.aero).
    note: >-
      No tenant-specific /.well-known/openid-configuration is published on any
      Heathrow host, so the issuer, supported flows and scopes are not
      externally discoverable.
  - name: mutual-tls-client-certificate
    type: mutualTLS
    layer: api-gateway (machine)
    host: https://api.heathrow.com
    evidence: >-
      Every path under https://api.heathrow.com returns HTTP 400 from
      Microsoft-Azure-Application-Gateway/v2 with the body "400 No required SSL
      certificate was sent". The same rejection occurs at
      https://apimgmt.lhr.aero/ root. The developer portal's own sitemap lists
      /documentation/requesting-a-client-certificate, confirming Heathrow issues
      client certificates - though that page itself returns 404.
    note: >-
      The certificate request process is documented in the sitemap but the
      document does not resolve; obtaining a certificate runs through the
      enrolment channel below.
onboarding:
  model: application-approval
  steps:
    - Contact Heathrow at support@heathrow.com or 08443351801 and state what type of user you are and why you want to use the APIs.
    - Heathrow returns enrolment details and runs an approval process.
    - On approval an account is provisioned and access is via Microsoft Active Directory.
    - Product entitlement is chosen during enrolment.
  verbatim: >-
    "In order to get the access to our APIs you need to get a personal account
    or an account for you team, for security and privacy reasons before we grant
    you access to the APIs, we need to know what type of user you are and why
    you want to use the APIs. ... Once you contacted us we'll give you the
    details to start our enrolling process, once you account is ready you'll be
    able to access using the Microsoft active directory and you'll have
    unlimited access to the product you choose during the enrolment procedure."
  source: https://developer.heathrow.com/how-it-works
  contact:
    email: support@heathrow.com
    phone: '08443351801'
not_observed:
  - api_key: >-
      Azure API Management normally issues per-subscription keys
      (Ocp-Apim-Subscription-Key), and the portal's /products page is the
      standard APIM subscription surface - but the products list renders empty
      to anonymous visitors and Heathrow documents no key header publicly, so no
      api-key scheme is asserted here.
  - oauth2: >-
      A /signup-oauth page exists in the portal sitemap (HTTP 200) but exposes no
      authorization or token endpoint, and no OAuth metadata is published.
  - scopes: >-
      No scope or permission reference is published; scopes/ is intentionally
      absent for this provider.