generated: '2026-08-26' method: searched source: >- https://api.rainfocus.com/.well-known/openid-configuration (probed) + https://experienceleague.adobe.com/en/docs/experience-platform/destinations/catalog/marketing-automation/rainfocus (RainFocus-authored connector documentation) + https://www.rainfocus.com/privacy-security/api-terms-and-conditions/ docs: https://www.rainfocus.com/privacy-security/api-terms-and-conditions/ description: >- RainFocus publishes no OpenAPI, so no securityScheme block could be derived. This profile is assembled from three things that ARE public: the OIDC/OAuth discovery documents RainFocus serves itself, the live behaviour of api.rainfocus.com and its MCP endpoint under an unauthenticated request, and the RainFocus-authored setup instructions carried in the Adobe Experience Platform destination connector. Nothing here is invented and no credential values appear. derivation_note: >- derive-authentication.py was not run - it reads openapi/ securitySchemes and this repo has no spec. Everything below is probed or read from published documentation. schemes: - id: api-profile type: apiKey in: header name: apiProfile required: true description: >- Every request to a /api path on api.rainfocus.com must name an API Profile. An API Profile is a named integration configuration created per customer in the RainFocus Integration Suite that declares which endpoints are enabled (for example Attendee Store) and carries the modular field mappings for that integration. Omitting it returns HTTP 400 with responseCode 103 and "Required parameter missing: apiProfile". evidence: request: GET https://api.rainfocus.com/api status: 400 body: '{"responseCode":"103","responseMessage":"Required parameter missing: apiProfile"}' companion_headers: - rfApiProfileId - authToken - rfAuthToken - rfWidgetId - widget - rfcsrf - extraFields companion_headers_note: >- Observed in the Access-Control-Allow-Headers response header on api.rainfocus.com. Their individual semantics are not publicly documented and are not guessed at here. - id: oauth2-global type: oauth2 flow: client_credentials description: >- RainFocus API Profiles can be created with "OAuth (Global)", which issues a Client ID and Client Secret used by server-to-server integrations. This is the credential model the Adobe Experience Platform RainFocus destination requires: "Create a RainFocus API Profile with OAuth (Global)", ensure the Attendee Store endpoint is enabled, and generate a Client ID and Client Secret. parameters_required_by_integrators: - name: environment example_values: [dev, prod] - name: orgId note: unique organization identifier for the customer's RainFocus instance - name: eventId note: RainFocus event code identifying the destination event token_endpoint: null token_endpoint_note: >- Not published. The customer-facing token URL is delivered with the profile credentials, not on the public web. source: >- https://experienceleague.adobe.com/en/docs/experience-platform/destinations/catalog/marketing-automation/rainfocus - a connector page RainFocus itself authors and maintains. - id: oidc type: openIdConnect openIdConnectUrl: https://api.rainfocus.com/.well-known/openid-configuration issuer: https://events.rainfocus.com/oidc description: >- A full OpenID Connect provider fronted by both api.rainfocus.com and events.rainfocus.com. This is the authorization server the MCP endpoint delegates to. authorization_endpoint: https://events.rainfocus.com/oidc/auth token_endpoint: https://events.rainfocus.com/oidc/token userinfo_endpoint: https://events.rainfocus.com/oidc/userData jwks_uri: https://events.rainfocus.com/oidc/.well-known/jwks scopes_supported: [openid] response_types_supported: - code - id_token - token - code id_token - code token - id_token token - code id_token token response_modes_supported: [query] grant_types_supported: [authorization_code, refresh_token] token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post] id_token_signing_alg_values_supported: [RS256] subject_types_supported: [public] pkce_supported: false pkce_note: >- code_challenge_methods_supported is absent from the discovery document, so PKCE support is not advertised. That is a real gap for a public MCP client. - id: mcp-bearer type: http scheme: bearer description: >- The RainFocus Nexus MCP endpoint requires an OAuth bearer token in the Authorization header. An unauthenticated tools/list POST returns 401 with a WWW-Authenticate challenge naming RFC 9728 protected-resource metadata, which is the discovery path an MCP client follows to find the authorization server. applies_to: https://api.rainfocus.com/mcp/ bearer_token_methods_supported: [header] authorization_servers: [https://events.rainfocus.com/oidc] token_lifetime: >- RainFocus describes short-lived, scoped access tokens plus refresh tokens with per-user authentication, role-based access control and per-event scoping. evidence: request: POST https://api.rainfocus.com/mcp/ tools/list status: 401 www_authenticate: Bearer resource_metadata="https://events.rainfocus.com/.well-known/oauth-protected-resource/mcp//" credential_handling_obligations: source: https://www.rainfocus.com/privacy-security/api-terms-and-conditions/ obligations: - Customer must maintain the confidentiality of all API keys, MCP credentials, tokens and endpoints. - Sharing, distributing or exposing API keys, MCP credentials, tokens or endpoints to any unauthorized person or system is prohibited. - Bypassing or circumventing usage limits, rate limits, authentication or security controls is prohibited. - On termination, Customer must destroy all copies of API keys, MCP credentials, tokens and cached API responses. gaps: - No public authentication reference page; the auth model must be reconstructed from a partner connector doc. - No PKCE advertised in OIDC discovery. - scopes_supported is only "openid" - no resource scopes are published for either the REST API or the MCP server. - No token endpoint published for the OAuth (Global) client-credentials flow.