# Sempra Energy > Sempra Energy is a San Diego-headquartered North American energy infrastructure holding company > and Fortune 500 constituent. It operates regulated utilities and energy infrastructure across > California, Texas and Mexico — San Diego Gas & Electric and Southern California Gas Company in > California, Oncor Electric Delivery in Texas, and Sempra Infrastructure (LNG export terminals, > natural gas pipelines, renewable generation). ## What an agent can actually call today **Nothing, without credentials.** Sempra Energy runs a Google Apigee API program with a live, routed, OAuth-protected proxy — but as of 2026-08-28 no API product, contract, reference, plan or rate limit is published to unauthenticated visitors. There is no OpenAPI, AsyncAPI, GraphQL SDL, MCP server, A2A agent card, SDK, or `.well-known` document on any Sempra Energy host. A live proxy IS routed at `https://api.sempra.com/v1`: GET https://api.sempra.com/v1/graphql 401 Unauthorized WWW-Authenticate: Bearer realm="null",error="invalid_token" {"fault":{"faultstring":"Invalid access token","detail":{"errorcode":"oauth.v2.InvalidAccessToken"}}} Every path under `/v1` behaves this way, while `/v2/graphql` and `/oauth/token` return the Apigee "no proxy routed" 404. Presenting an unknown bearer token changes the fault to `keymanagement.service.invalid_access_token`, confirming tokens are validated against Apigee key management. The gateway advertises `GET, PUT, POST, DELETE, OPTIONS, PATCH` under a wildcard CORS policy, so there is a genuine read/write surface behind the token — with no published operation, schema, scope, grant type or token endpoint. Obtaining credentials requires registering at https://developer.sempra.com. ## The API program - **API gateway** — `https://api.sempra.com`. A live Google Apigee runtime. An unrouted request returns the genuine Apigee fault `{"fault":{"faultstring":"Unable to identify proxy for host: apigee_host and url: /","detail":{"errorcode":"messaging.adaptors.http.flow.ApplicationNotFound"}}}` (HTTP 404, `application/json`). Serves `Strict-Transport-Security: max-age=86400`. - **Developer portal** — https://developer.sempra.com. A Google Apigee integrated developer portal (Apigee organization `sempra`, portal site id `sempra-prod`). Its home page reads "Sempra Developer Portal — Sign up today and start using Sempra APIs". - **Routed basepath** — `https://api.sempra.com/v1`. OAuth 2.0 bearer required (RFC 6750 challenge). `/v1/graphql`, `/v1/token` and `/v1/graphql/health` all route; `/v2/*` does not. Whether `/v1/graphql` actually speaks GraphQL cannot be verified without a token, and no SDL is asserted here. - **Log in** — https://developer.sempra.com/login. The only nav item besides "APIs". Ownership of both hosts is established from their TLS certificates: DigiCert EV certificates whose subject is `O=Sempra Energy, L=San Diego, ST=California, C=US`. ## What the portal publishes anonymously The portal's own catalog endpoint answers without credentials and is empty: GET https://developer.sempra.com/portals/api/sites/sempra-prod/liveportal/apis 200 -> {"apiDocs":[],"apiProducts":[],"apiCategoryList":[{"name":"DEV"},{"name":"Use Case"}]} Two API categories are defined (`DEV`, `Use Case`) but no API product is assigned to the public portal. The portal's Terms and Conditions page still carries the placeholder text `(TO DO)`, and the Quick Start and Publish pages are unmodified Apigee sample content. ## Corporate site - **Website** — https://www.sempra.com (https://www.sempra-energy.com 301s here). Behind a Cloudflare managed challenge; unauthenticated crawlers receive HTTP 403. - **robots.txt** — https://www.sempra.com/robots.txt (HTTP 200). Content-Signal `search=yes, ai-train=no, use=reference`. `ClaudeBot`, `GPTBot`, `CCBot`, `Google-Extended`, `Amazonbot`, `Applebot-Extended`, `Bytespider` and `meta-externalagent` are all `Disallow: /`. Agents should honor this. - **LinkedIn** — https://www.linkedin.com/company/sempra ## Domain security (probed 2026-08-28) - `sempra.com`: SPF yes, DMARC yes (`p=reject`), DNSSEC no, CAA none. - `sempra-energy.com`: SPF no, DMARC no, DNSSEC no, CAA none. Redirect domain only. - HSTS served on `api.sempra.com` (max-age 86400) and `developer.sempra.com` (max-age 63072000, preload). - No `security.txt`, no published vulnerability-disclosure policy, no bug bounty, no trust center with named certifications was found on any Sempra Energy host. ## Artifacts in this profile - `apis.yml` — APIs.json profile. - `security/sempra-energy-domain-security.yml` — TLS/HSTS/DNSSEC/CAA/SPF/DMARC probe. - `well-known/sempra-energy-well-known.yml` — `.well-known` probe record (all misses). - `plans/sempra-energy-plans-pricing.yml` — `plan_count: 0`, with evidence. - `rate-limits/sempra-energy-rate-limits.yml` — `limit_count: 0`, with evidence. - `authentication/sempra-energy-authentication.yml` — probed OAuth 2.0 bearer profile. - `errors/sempra-energy-problem-types.yml` — the three observed Apigee fault codes. - `conventions/sempra-energy-conventions.yml` — probed cross-cutting semantics and the reversibility assessment. - `packages/sempra-energy-packages.yml` — verified zero: no SDK in npm, PyPI, RubyGems or crates.io, and no public GitHub organization. - `blogs/`, `press/`, `search/` — harvested Sempra newsroom and coverage. ## If you are Sempra Energy Publishing your Apigee API products to the public portal, and exporting their OpenAPI specs to a stable public URL, would make this surface discoverable and callable. Gate the credentials, not the contract. Corrections and re-scores are free: info@apievangelist.com