generated: '2026-08-28'
method: probed
source: https://polarisdealers.auth0.com/.well-known/openid-configuration
docs: null
note: >-
  Polaris Inc. publishes no public API and no developer portal, so there is no OpenAPI
  securitySchemes block to derive from. What IS reachable and unauthenticated is the OpenID
  Connect discovery document for the identity tenant that fronts the Polaris dealer portal
  (www.polarisportal.com / www.polarisdealers.com). Everything below is read verbatim from
  that document — nothing is inferred about the APIs it protects, because those are not
  published. The dealer portal itself is a partner login, not an API program.
surfaces:
- name: Polaris Dealer Portal identity (Auth0 tenant)
  audience: https://polarisportal.com
  relying_parties:
  - https://www.polarisportal.com/
  - https://www.polarisdealers.com/
  issuer: https://polarisdealers.auth0.com/
  discovery: https://polarisdealers.auth0.com/.well-known/openid-configuration
  http_status: 200
  schemes:
  - type: openIdConnect
    openIdConnectUrl: https://polarisdealers.auth0.com/.well-known/openid-configuration
    authorization_endpoint: https://polarisdealers.auth0.com/authorize
    token_endpoint: https://polarisdealers.auth0.com/oauth/token
    userinfo_endpoint: https://polarisdealers.auth0.com/userinfo
    jwks_uri: https://polarisdealers.auth0.com/.well-known/jwks.json
    revocation_endpoint: https://polarisdealers.auth0.com/oauth/revoke
    registration_endpoint: https://polarisdealers.auth0.com/oidc/register
    device_authorization_endpoint: https://polarisdealers.auth0.com/oauth/device/code
    mfa_challenge_endpoint: https://polarisdealers.auth0.com/mfa/challenge
    grant_types:
    - authorization_code
    - client_credentials
    - refresh_token
    - implicit
    - password
    - urn:ietf:params:oauth:grant-type:device_code
    - urn:ietf:params:oauth:grant-type:token-exchange
    - urn:ietf:params:oauth:grant-type:jwt-bearer
    - http://auth0.com/oauth/grant-type/password-realm
    - http://auth0.com/oauth/grant-type/passwordless/otp
    - http://auth0.com/oauth/grant-type/mfa-oob
    - http://auth0.com/oauth/grant-type/mfa-otp
    - http://auth0.com/oauth/grant-type/mfa-recovery-code
    response_types:
    - code
    - token
    - id_token
    - code token
    - code id_token
    - token id_token
    - code token id_token
    response_modes:
    - query
    - fragment
    - form_post
    pkce:
      supported: true
      code_challenge_methods:
      - S256
      - plain
      observed_in_use: S256
      evidence: >-
        The live dealer-portal redirect carries code_challenge_method=S256, so the deployed
        flow is authorization_code + PKCE, not implicit.
    token_endpoint_auth_methods:
    - client_secret_basic
    - client_secret_post
    - private_key_jwt
    - none
    token_endpoint_auth_signing_algs:
    - RS256
    - RS384
    - PS256
    mfa: true
- name: api.polaris.com
  http_status: 500
  schemes: []
  note: >-
    Live gateway host (IBM DataPower / API Connect signature x-backside-transport: FAIL FAIL
    behind Cloudflare). Every anonymous path returns HTTP 500 with a zero-length body, so no
    authentication scheme could be observed. Recorded as present-but-unreadable, not absent.