generated: '2026-07-27'
method: searched
source: >-
  live anonymous HTTPS probes of every apis.yml surface on 2026-07-27, plus
  review.yml authModel section
docs: null
docs_note: >-
  Manitoba Hydro publishes no developer authentication documentation of any
  kind. There is no developer portal, no key issuance page, and no token
  endpoint. This profile was established by probing, not by reading a doc.
summary:
  types: [none]
  api_key_in: []
  oauth2_flows: []
  anonymous: true
  registration_required: false
  credentials_issued: false
model: >-
  Anonymous by default on every published surface. Every Manitoba Hydro API
  surface catalogued in apis.yml answered an unauthenticated request with no
  key, token, referer allow-list entry, or registration. There is nothing to
  obtain and nothing to rotate. The absence of authentication here is not a
  security posture decision about an API programme — it is the by-product of a
  GIS team sharing ArcGIS Online items publicly and a hydrology team publishing
  static JSON behind a public web application.
schemes:
- name: none
  type: none
  applies_to:
  - manitoba-hydro:manitoba-hydro-current-power-outages
  - manitoba-hydro:manitoba-hydro-planned-power-outages
  - manitoba-hydro:manitoba-hydro-arcgis-server-reference-data
  - manitoba-hydro:manitoba-hydro-hydrological-data
  evidence:
  - url: https://services2.arcgis.com/QoeQkfdOG126FqSi/arcgis/rest/services/Manitoba_Hydro_Current_Power_Outages/FeatureServer/0/query?where=1%3D1&outFields=*&returnGeometry=false&resultRecordCount=3&f=json
    status: 200
    note: Anonymous attribute query returned features with no token parameter.
  - url: https://services2.arcgis.com/QoeQkfdOG126FqSi/arcgis/rest/services/Manitoba_Hydro_Planned_Power_Outages/FeatureServer/0/query?where=1%3D1&outFields=*&returnGeometry=false&resultRecordCount=3&f=json
    status: 200
    note: Anonymous attribute query returned features with no token parameter.
  - url: https://maps.hydro.mb.ca/arcgis/rest/services/ReferenceData/MH_AdminBoundaries/FeatureServer/0/query?where=1%3D1&outFields=*&returnGeometry=false&resultRecordCount=3&f=json
    status: 200
    note: >-
      Anonymous query against Manitoba Hydro's own ArcGIS Server host. The host
      root at https://maps.hydro.mb.ca/ returns HTTP 403; only the
      /arcgis/rest/services tree is readable.
  - url: https://dservices2.arcgis.com/QoeQkfdOG126FqSi/arcgis/services/Manitoba_Hydro_Current_Power_Outages_WFS/WFSServer?service=wfs&request=getcapabilities
    status: 200
    note: Anonymous WFS 2.0.0 GetCapabilities.
  - url: https://www.hydro.mb.ca/hydrologicalData/static/data/tsdata.json
    status: 200
    note: >-
      Anonymous, but an F5 web application firewall on www.hydro.mb.ca
      intermittently answers HTTP 200 with a "Request Rejected" HTML body when
      the request does not look like a browser. Sending a browser User-Agent and
      a Referer of https://www.hydro.mb.ca/hydrologicalData/static/ gets through
      reliably. This is a bot-mitigation filter, not authentication.
token_endpoints: []
discovery:
  openid_configuration: null
  oauth_authorization_server: null
  probed:
  - {url: 'https://www.hydro.mb.ca/.well-known/openid-configuration', status: 404}
  - {url: 'https://www.hydro.mb.ca/.well-known/oauth-authorization-server', status: 404}
  - {url: 'https://account.hydro.mb.ca/.well-known/openid-configuration', status: 404}
  - {url: 'https://account.hydro.mb.ca/.well-known/oauth-authorization-server', status: 404}
consumer_authentication:
  scheme: username-password
  url: https://account.hydro.mb.ca/Portal
  platform: Smart Energy Water — Smart Customer Mobile (Android package com.sew.manitoba)
  third_party_delegation: none
  note: >-
    The only place a Manitoba Hydro customer's own usage or billing data lives is
    behind an interactive login at account.hydro.mb.ca. There is no OAuth
    authorization server, no consent screen, no delegated-access programme, and
    no accredited-recipient regime — Manitoba has no consumer energy data
    mandate and Manitoba Hydro has no advanced metering infrastructure producing
    interval data in the first place. The portal's vendor backend is visible at
    https://account.hydro.mb.ca/API/ ("SCM Service API", HTTP 200) but lists no
    operations and its help page returns HTTP 403; it is a first-party SaaS
    backend, not a third-party API.
agent_guidance: >-
  An agent can call every surface in this repo directly over HTTPS with no
  credential handling at all. Send a realistic User-Agent, and for
  www.hydro.mb.ca also send a Referer matching the hydrological application, or
  the WAF will return an HTTP 200 "Request Rejected" page that is not JSON. Do
  not attempt to reach consumer usage data — no API path to it exists.