generated: '2026-08-25' method: probed source: https://auth0.metabolon.com/.well-known/openid-configuration docs: https://www.metabolon.com/support/portal/data/ note: >- The publicly served PortalApi OpenAPI declares NO components.securitySchemes and no top-level security requirement, so nothing could be derived from the contract — derive-authentication.py returned zero schemes. The auth model below is read from the live OIDC discovery document on Metabolon's own Auth0 custom domain (auth0.metabolon.com) plus the Auth0 SPA client wired into the portal.metabolon.com React bundle. Metabolon publishes no developer authentication documentation; there is no API key programme, no self-service credential issuance, and no machine/service-account path documented anywhere public. summary: model: oauth2-oidc provider: Auth0 (Metabolon-branded custom domain) issuer: https://auth0.metabolon.com/ legacy_issuer: https://metabolon.auth0.com/ runtime_credential: Bearer JWT (RS256) presented to the *.prod.metabolon.com services self_service: false api_keys: false mtls: false declared_in_spec: false schemes: - name: Auth0 OIDC type: openIdConnect openIdConnectUrl: https://auth0.metabolon.com/.well-known/openid-configuration discovery_file: well-known/metabolon-openid-configuration.json endpoints: authorization: https://auth0.metabolon.com/authorize token: https://auth0.metabolon.com/oauth/token userinfo: https://auth0.metabolon.com/userinfo jwks: https://auth0.metabolon.com/.well-known/jwks.json revocation: https://auth0.metabolon.com/oauth/revoke registration: https://auth0.metabolon.com/oidc/register device_authorization: https://auth0.metabolon.com/oauth/device/code mfa_challenge: https://auth0.metabolon.com/mfa/challenge grant_types: - authorization_code - refresh_token - client_credentials - implicit - password - urn:ietf:params:oauth:grant-type:device_code - urn:ietf:params:oauth:grant-type:token-exchange - urn:ietf:params:oauth:grant-type:jwt-bearer - http://auth0.com/oauth/grant-type/password-realm - http://auth0.com/oauth/grant-type/passwordless/otp - http://auth0.com/oauth/grant-type/mfa-oob - http://auth0.com/oauth/grant-type/mfa-otp - http://auth0.com/oauth/grant-type/mfa-recovery-code response_types: - code - token - id_token - code token - code id_token - token id_token - code token id_token token_endpoint_auth_methods: - client_secret_basic - client_secret_post - private_key_jwt - none id_token_signing_algs: - RS256 - HS256 - PS256 pkce: supported: true code_challenge_methods: - S256 - plain mfa: supported: true evidence: mfa_challenge_endpoint present plus mfa-oob / mfa-otp / mfa-recovery-code grant types backchannel_logout_supported: true request_uri_parameter_supported: false scopes: scopes/metabolon-scopes.yml identity_flows: - name: Portal sign-in description: Auth0 SPA authorization-code + PKCE flow initiated from https://portal.metabolon.com/login; the resulting access token is sent as a bearer credential to portal-api.prod.metabolon.com. evidence: auth0-spa-js bundled in portal.metabolon.com/static/js/main.63f8c925.js - name: Pre-user-registration hook description: Auth0 Action calls POST /api/v1/auth0/pre-user-registration on the Portal API to gate who may create an account. operation: openapi/metabolon-portal-api-openapi.yml#Auth_OnPreUserRegistration - name: Post-login hook description: Auth0 Action calls POST /api/v1/auth0/post-login on the Portal API after successful authentication. operation: openapi/metabolon-portal-api-openapi.yml#Auth_OnPostLogin - name: Salesforce connection verification description: GET /api/v1/auth0/verify-salesforce confirms the authenticating user maps to a Salesforce record; unapproved users go through an admin approval queue. operation: openapi/metabolon-portal-api-openapi.yml#Auth_VerifySalesforceConnection - name: Authorized context description: GET /api/v1/auth/context returns the caller's resolved roles, permissions and project entitlements (IAuthorizedContext). operation: openapi/metabolon-portal-api-openapi.yml#Auth_GetAuthorizedContext - name: Learning centre authorization description: POST /api/v1/auth0/learning-center/authorize brokers access to the TalentLMS learning centre. operation: openapi/metabolon-portal-api-openapi.yml#Auth_AuthorizeLearningCenterAccess - name: Assistant token exchange description: POST /api/v1/assistant/token/{tenant} mints a scoped token for the in-portal assistant per tenant. operation: openapi/metabolon-portal-api-openapi.yml#Assistant_GetToken authorization: model: role-and-project entitlement note: >- Authorization is enforced per project, not per scope. A user is granted membership of specific projects (UserProject) and named roles carrying permissions from a server-side catalog (GET /api/v1/admin/users/roles/permissions/catalog). OAuth scopes on the token are the stock Auth0 OIDC profile scopes and carry no API authorization meaning. permission_catalog_operation: openapi/metabolon-portal-api-openapi.yml#Users_GetPermissionsCatalog role_operations: - openapi/metabolon-portal-api-openapi.yml#Users_GetRoles - openapi/metabolon-portal-api-openapi.yml#Users_GetRolePermissions - openapi/metabolon-portal-api-openapi.yml#Users_AddRolePermission - openapi/metabolon-portal-api-openapi.yml#Users_RemoveRolePermission transport_security: tls: TLSv1.3 on every probed host hsts: enabled on www.metabolon.com (max-age 31536000); absent on the *.prod.metabolon.com API hosts encryption_at_rest: stated on https://www.metabolon.com/support/portal/data/ source: security/metabolon-domain-security.yml gaps: - No securitySchemes are declared in any of the four published OpenAPI documents. - No public developer authentication documentation, no API key issuance, no documented service-account or client-credentials path for customers. - The published OpenAPI is served unauthenticated, but every non-health operation it describes requires a portal account.