generated: '2026-08-28'
method: searched
source: >-
  openapi/smarter-sorting-customer-classification-v1-openapi.yml (derived baseline via
  derive-authentication.py), upgraded from the provider's own auth documentation at
  https://api.smartersorting.com/docs#setup (HTTP 200) and confirmed against a live
  unauthenticated call to https://api.smartersorting.com/classification/v1/products (HTTP 401).
docs: https://api.smartersorting.com/docs#setup
summary:
  types:
  - http
  oauth2: false
  openid_connect: false
  mtls: false
  api_key: false
schemes:
- name: api_key
  type: http
  scheme: bearer
  header: Authorization
  value_format: 'Bearer <API key>'
  issuance: >-
    Human sign-in to the developer portal using Auth0 credentials mints a static bearer key. There
    is no programmatic key-issuance endpoint, no client-credentials flow, and no token exchange —
    an agent cannot obtain a credential without a human first logging into the portal.
  environments:
  - name: production
    portal: https://api.smartersorting.com/docs
    base_url: https://api.smartersorting.com
  - name: staging
    portal: https://api.staging.smarterx.com/docs
    base_url: https://api.staging.smarterx.com
  key_prefix_convention: none
  key_prefix_note: >-
    No prefix distinguishes a staging key from a production key, so a credential alone does not
    reveal which environment it addresses — only the host does.
  rotation_policy_published: false
  scopes: []
  sources:
  - openapi/smarter-sorting-customer-classification-v1-openapi.yml
  - https://api.smartersorting.com/docs#setup
  applies_to:
  - getProductByFieldMatch
  - getListOfProducts
  - getCountOfProducts
  - putProductAttributesByIdentifier
  - patchProductAttributesByIdentifier
  - bulkUploadProducts
anonymous_operations:
- operationId: customerClassificationAPIDocs
  path: /classification/v1/docs
  note: >-
    The OpenAPI self-description is served anonymously — confirmed HTTP 200 with no credential on
    both api.smartersorting.com and api.smarterx.com. This is the reason the provider has a
    discoverable machine-readable contract at all.
observations:
- >-
  The spec declares Authorization BOTH as an httpBearer securityScheme AND as an explicit required
  header parameter on every business operation. That duplication is redundant under OpenAPI 3.1 and
  will make some generators emit the header twice. Recorded in
  overlays/smarter-sorting-customer-classification-v1-overlay.yaml.
- >-
  No OAuth or OIDC discovery is served: /.well-known/oauth-authorization-server,
  /.well-known/oauth-protected-resource and /.well-known/openid-configuration all return 404 on
  every probed host. Auth0 is used for portal sign-in only, not as an API-caller authorization flow.