generated: '2026-07-27' method: searched source: >- https://www.pge.com/en/save-energy-and-money/energy-saving-programs/smartmeter/third-party-companies.html (HTTP 200, fetched 2026-07-27) and https://www.pge.com/assets/pge/docs/save-energy-and-money/energy-savings-programs/OAuth_Authorization_ESPI.pdf (HTTP 200). Upgraded from the derived pass over openapi/green-button-alliance-espi-openapi.json, whose declared server is the Green Button Alliance sandbox and NOT a PG&E host. docs: https://www.pge.com/en/save-energy-and-money/energy-saving-programs/smartmeter/third-party-companies.html description: >- PG&E Share My Data authenticates third parties with OAuth 2.0 (NAESB ESPI authorization profile) layered on MANDATORY mutual TLS 1.2. This is not OpenID Connect: /.well-known/openid-configuration returns HTTP 404 on www.pge.com, api.pge.com and sharemydata.pge.com (re-probed 2026-07-27). Two bearer-token classes are issued from separate grants, and a third registration token governs the ApplicationInformation resource. summary: types: [oauth2, mutualTLS, http] oauth2_flows: [authorizationCode, clientCredentials, refreshToken] api_key_in: [] openid_connect: false mutual_tls_required: true schemes: - name: MutualTLS type: mutualTLS required: true tls_version: TLS 1.2 certificate: >- Third party must present an unexpired, unrevoked SHA-2 X.509 client certificate with an RSA public key of at least 2048 bits, issued by a recognized public certificate authority. PG&E names AddTrust, Comodo, DigiCert, Entrust, GlobalSign, Go Daddy, USERTrust and VeriSign. Self-signed certificates are explicitly not accepted. applies_to: >- Every request between the third party and PG&E except the browser redirects in the OAuth authorization-code flow, including the token endpoint call. verified: >- Anonymous GET of every ESPI resource path returns HTTP 400 "Invalid Certificate" from Mulesoft-API-Gateway, while invented sibling paths return HTTP 404 "No listener for endpoint" (2026-07-27). source: docs - name: OAuth2ClientCredentials type: oauth2 flow: clientCredentials token_endpoint: https://api.pge.com/datacustodian/oauth/v2/token test_token_endpoint: https://api.pge.com/datacustodian/test/oauth/v2/token client_authentication: >- HTTP Basic — Authorization: Basic base64(client_ID:client_Secret) — with grant_type=client_credentials. issues: client_access_token token_type: Bearer token_lifetime_seconds: 3600 refresh_token_lifetime: 1 year response_format: >- XML Response document with client_access_token, expires_in, scope and token_type elements (PG&E's published connectivity-test example). used_for: >- Third-party-level resources — DownloadSampleData, ReadServiceStatus, the Authorization feed and detail, and the Bulk-level Batch resources. source: docs - name: OAuth2AuthorizationCode type: oauth2 flow: authorizationCode authorization_endpoint_production: https://sharemydata.pge.com/myAuthorization authorization_endpoint_test: https://api.pge.com/datacustodian/test/oauth/v2/authorize token_endpoint: https://api.pge.com/datacustodian/oauth/v2/token test_token_endpoint: https://api.pge.com/datacustodian/test/oauth/v2/token client_authentication: >- HTTP Basic — Authorization: Basic base64(client_ID:client_Secret) — with grant_type=authorization_code, code and redirect_uri. authorization_code_lifetime_seconds: 600 issues: access_token + refresh_token token_type: bearer token_lifetime_seconds: 3600 refresh_token_lifetime: 1 year state_parameter: supported (optional, echoed back) scope_model: >- ESPI function-block scope string rather than named OAuth scopes — see scopes/pge-scopes.yml. used_for: >- Per-customer resources — LocalTimeParameters, ReadingType, the Subscription/UsagePoint/MeterReading/IntervalBlock/UsageSummary trees and the customer-level Batch resources. customer_journey: >- The PG&E customer authenticates on PG&E's own site (or the Guest Access tab) and selects data groups, interval duration and authorization period (defined period or Indefinite). A customer may cancel; a third party may revoke with HTTP DELETE on the Authorization resource. source: docs - name: RegistrationAccessToken type: http scheme: bearer token: registration_access_token issued_at: registration, via the Share My Data third-party portal used_for: >- The ApplicationInformation resource, which returns the third party's own registered application record. source: docs - name: oauth2 type: oauth2 first_party: false note: >- Retained from the derived pass over the Green Button Alliance OpenAPI. Its URLs are the GBA sandbox (https://sandbox.greenbuttonalliance.org:8443), NOT PG&E hosts. Kept only to document the standard contract. flows: - flow: authorizationCode authorizationUrl: https://sandbox.greenbuttonalliance.org:8443/oauth/authorize tokenUrl: https://sandbox.greenbuttonalliance.org:8443/oauth/token scopes: 0 - flow: clientCredentials tokenUrl: https://sandbox.greenbuttonalliance.org:8443/oauth/token scopes: 0 sources: - openapi/green-button-alliance-espi-openapi.json openid_connect: served: false probed: '2026-07-27' probes: - {url: 'https://www.pge.com/.well-known/openid-configuration', status: 404} - {url: 'https://api.pge.com/.well-known/openid-configuration', status: 404} - {url: 'https://sharemydata.pge.com/.well-known/openid-configuration', status: 404} oauth_metadata: rfc8414_served: false probed: '2026-07-27' probes: - {url: 'https://api.pge.com/.well-known/oauth-authorization-server', status: 404} - {url: 'https://www.pge.com/.well-known/oauth-authorization-server', status: 404} access_gate: >- Credentials are not self-serve. A client_id/client_secret pair is issued only after registration at https://sharemydata.pge.com/ with a US EIN, CPUC eligibility screening, tariff acceptance and completion of the mandatory connectivity and OAuth tests within 90 days. related: - scopes/pge-scopes.yml - conventions/pge-conventions.yml - sandbox/pge-sandbox.yml