generated: '2026-08-25'
method: probed
source: https://metalenz.com/wp-json/
docs: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
description: >-
  Metalenz publishes no developer program and issues no API credentials. The WordPress REST content
  API behind metalenz.com is anonymously readable — no key, token, signature or account is required
  to read press releases, pages, media, taxonomies, search, oEmbed or the discovery metadata. The
  server declares exactly one authentication method in its own root document, WordPress application
  passwords, and that method gates only the write and privileged-read operations that are not part
  of the public surface. Separately, Metalenz runs a credential-gated documentation portal at
  docs.metalenz.com behind Microsoft Entra ID; that is a human login, not an API credential.
summary:
  types: []
  anonymous_read: true
  credentialed_write: true
  api_key_in: []
  oauth2_flows: []
  note: >-
    No securityScheme appears in any of the seven derived OpenAPI documents because the public
    surface genuinely has none. This is a recorded absence, not a gap in harvesting.
schemes: []
declared_by_server:
- name: application-passwords
  type: http
  scheme: basic
  description: >-
    WordPress application passwords (RFC 7617 Basic over TLS, username + generated application
    password). Declared in the `authentication` block of the API root document. Required for every
    write method and for privileged reads such as GET /wp/v2/settings, /wp/v2/themes,
    /wp/v2/plugins, /wp/v2/menus and the whole widget/template/global-styles surface. Credentials
    are issued per WordPress user from the site admin — there is no public registration path, so
    this is a staff-only credential, not a developer credential.
  authorization_endpoint: https://metalenz.com/wp-admin/authorize-application.php
  source: https://metalenz.com/wp-json/
adjacent_identity_systems:
- name: Microsoft Entra ID (Azure AD)
  applies_to: https://docs.metalenz.com/documentation/
  protocol: OpenID Connect 1.0 (implicit id_token, prompt=select_account)
  tenant: 8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361
  issuer: https://login.microsoftonline.com/8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361/v2.0
  authorization_endpoint: https://login.microsoftonline.com/8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361/oauth2/v2.0/authorize
  scopes_supported: [openid, profile, email, offline_access]
  detail: >-
    docs.metalenz.com serves a two-line landing page linking to /documentation/, which 301s to
    /documentation/ and then redirects into the Microsoft Entra ID authorize endpoint for the
    Metalenz tenant. This is Metalenz's customer/partner documentation for its optics products and
    it is not reachable without an account. It is recorded here because it is the only identity
    surface Metalenz operates, but it protects human documentation, not an API: no API is
    advertised behind it and no protected-resource metadata is published. The tenant and client
    identifiers above are public values emitted in the redirect URL, not secrets.
evidence:
- url: https://metalenz.com/wp-json/
  http_status: 200
  finding: 'authentication: {"application-passwords": {"endpoints": {"authorization": "https://metalenz.com/wp-admin/authorize-application.php"}}}'
- url: https://metalenz.com/wp-json/wp/v2/posts?per_page=2
  http_status: 200
  finding: 'Anonymous read succeeds; response carries `Allow: GET`, confirming read-only anonymous access. X-WP-Total 26.'
- url: https://metalenz.com/wp-json/wp/v2/media?per_page=2
  http_status: 200
  finding: Anonymous read of the media library succeeds, X-WP-Total 418.
- url: https://metalenz.com/wp-json/wp/v2/settings
  http_status: 401
  finding: '{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}'
- url: https://metalenz.com/wp-json/wp/v2/themes
  http_status: 401
  finding: 'Privileged read is credential-gated: {"code":"rest_cannot_view_themes",...}'
- url: https://docs.metalenz.com/documentation
  http_status: 301
  finding: 301 to /documentation/, which redirects into login.microsoftonline.com — Entra ID gate.
- url: https://login.microsoftonline.com/8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361/v2.0/.well-known/openid-configuration
  http_status: 200
  finding: OpenID Provider metadata for the Metalenz tenant; confirms the gate is OIDC.
x-evidence:
  fetched: '2026-08-25'
  probes: 7