generated: '2026-08-13'
method: probed
source: >-
  Live unauthenticated requests to https://api.reviewtrackers.com/ (root, /auth,
  /accounts, /reviews, /locations, /users) on 2026-08-13
docs: https://developer.reviewtrackers.com/
name: ReviewTrackers API Authentication
description: >-
  Authentication profile for the ReviewTrackers REST API, established by probing
  the live production host rather than from an OpenAPI document — ReviewTrackers
  publishes no machine-readable specification and its developer portal is
  credential-gated. Every protected resource answers an anonymous request with
  HTTP 401 and an HTTP Basic challenge; there is a dedicated /auth token-exchange
  endpoint that accepts a set of vendored JSON media types.
summary:
  types:
    - http
  http_schemes:
    - basic
  api_key_in: []
  oauth2_flows: []
  oauth2: false
  openid_connect: false
  mutual_tls: false
schemes:
  - name: basic
    type: http
    scheme: basic
    realm: rtx:production
    in: header
    parameter: Authorization
    description: >-
      HTTP Basic authentication. Every protected collection returns
      WWW-Authenticate Basic realm="rtx:production" to an anonymous caller.
    evidence:
      - request: GET https://api.reviewtrackers.com/accounts
        status: 401
        www_authenticate: Basic realm="rtx:production"
        body: '{"error":"Must Be Authenticated.","status":401}'
      - request: GET https://api.reviewtrackers.com/locations
        status: 401
        www_authenticate: Basic realm="rtx:production"
      - request: GET https://api.reviewtrackers.com/users
        status: 401
        www_authenticate: Basic realm="rtx:production"
token_exchange:
  endpoint: https://api.reviewtrackers.com/auth
  method: POST
  description: >-
    Credential exchange endpoint. Rejects a request with no Content-Type with HTTP
    415, enumerating the exact media types it accepts; rejects a request with no
    credentials with HTTP 401 and the Basic challenge. The token format returned
    on success is documented only inside the gated developer portal and was not
    observed in this pass.
  accepted_content_types:
    - application/json
    - application/json;charset=utf-8
    - application/hal+json
    - application/hal+json;charset=utf-8
    - application/vnd.rtx.hal+json
    - application/vnd.rtx.hal+json;charset=utf-8
    - application/vnd.rtx.auth.hal+json
    - application/vnd.rtx.auth.hal+json;charset=utf-8
    - application/vnd.rtx.v2.hal+json
    - application/vnd.rtx.v2.hal+json;charset=utf-8
    - application/vnd.rtx.auth.v2.hal+json
    - application/vnd.rtx.auth.v2.hal+json;charset=utf-8
  evidence:
    - request: POST https://api.reviewtrackers.com/auth (no Content-Type)
      status: 415
      body_excerpt: 'Unsupported content type ""; expected one of [...]'
    - request: POST https://api.reviewtrackers.com/auth (Content-Type application/json, empty body)
      status: 401
      content_type: application/vnd.rtx.auth.v2.hal+json;charset=utf-8
      www_authenticate: Basic realm="rtx:production"
key_management:
  self_service: false
  note: >-
    API credentials are not self-service. The API root itself responds
    {"message":"Contact your CS representative or reference
    https://developer.reviewtrackers.com/"} — credentials are issued by a customer
    success representative, and API access is a plan entitlement (see
    plans/reviewtrackers-plans-pricing.yml).
notes:
  - No OAuth 2.0, OpenID Connect, or API-key scheme was observed; there is therefore
    no scopes/ artifact for this provider.
  - >-
    No /.well-known/oauth-authorization-server or /.well-known/openid-configuration
    is served on any host (see well-known/reviewtrackers-well-known.yml).