generated: '2026-08-23'
method: probed
source: >-
  https://www.jnanatx.com/wp-json/ (route index `authentication` block) plus live anonymous
  and OPTIONS probes of the wp/v2 surface on 2026-08-23; contract shape defined upstream at
  https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
docs: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
summary: >-
  Jnana Therapeutics publishes no developer authentication documentation, because it publishes no
  developer program. The WordPress REST content API behind www.jnanatx.com is anonymously readable
  for its published-content routes and requires a WordPress account for everything else. The only
  credential mechanism the deployment advertises is WordPress Application Passwords, whose
  authorization endpoint is named in the REST index.
security_schemes: []
schemes:
- id: anonymous
  type: none
  status: in-use
  applies_to: >-
    All operations in openapi/jnana-therapeutics-content-openapi.yml. Every one of the 25 derived
    operations returned 200 with no credential on 2026-08-23.
  notes: >-
    `context=view` (the default) is anonymous. `context=edit` requires an authenticated session and
    returns 401 rest_forbidden without one.
- id: application-passwords
  type: http
  scheme: basic
  status: advertised
  advertised_at: https://www.jnanatx.com/wp-json/
  authorization_endpoint: https://www.jnanatx.com/wp-admin/authorize-application.php
  applies_to: >-
    Write operations and the administrative surface only. Not usable by the public — an account on
    the WordPress install is required, and no self-service registration is offered.
  notes: >-
    Declared verbatim in the REST index as
    authentication.application-passwords.endpoints.authorization. WordPress Application Passwords
    are transmitted as HTTP Basic credentials over TLS.
oauth2: false
openid_connect: false
mutual_tls: false
api_keys: false
anonymous_read: true
write_surface_anonymous: false
evidence:
- url: https://www.jnanatx.com/wp-json/wp/v2/posts?per_page=1
  method: GET
  status: 200
  note: Anonymous read succeeds.
- url: https://www.jnanatx.com/wp-json/wp/v2/posts
  method: OPTIONS
  status: 200
  note: '`allow: GET` — no write method is offered to an anonymous caller.'
- url: https://www.jnanatx.com/wp-json/wp/v2/settings
  method: GET
  status: 401
  note: 'rest_forbidden — "Sorry, you are not allowed to do that."'
- url: https://www.jnanatx.com/wp-json/wp-abilities/v1/abilities
  method: GET
  status: 401
  note: rest_forbidden.
- url: https://www.jnanatx.com/wp-json/contact-form-7/v1/contact-forms
  method: GET
  status: 403
  note: wpcf7_forbidden.
- url: https://www.jnanatx.com/wp-json/wp/v2/menu-items
  method: GET
  status: 401
  note: rest_cannot_view.
transport:
  https_only: true
  hsts: 'max-age=63072000; includeSubDomains; preload'
  tls_version: TLSv1.3
  cors:
    access_control_allow_headers: 'Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type'
    access_control_expose_headers: 'X-WP-Total, X-WP-TotalPages, Link'