generated: '2026-08-28'
method: probed
source: >-
  openapi/sojo-industries-victoria-agent-openapi.json (info.description + components.securitySchemes)
  plus live unauthenticated probes of https://api.sojoshield.com and the public sojoshield.com JS bundle
summary:
  types:
  - http
  model: >-
    Bearer JWT throughout. Sojo Industries uses Stytch as its identity provider for the Sojo
    Shield web app; the Stytch session JWT is the credential presented to both the Shield
    platform API and the Victoria agent API. There is no API-key surface, no OAuth
    authorization-server metadata document, and no published self-service key issuance —
    credentials come from a Shield tenant account.
schemes:
- name: BearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: 'Stytch session JWT. Pass as ''Authorization: Bearer <token>''.'
  applies_to:
    - 'POST /orchestrate'
    - 'POST /api/chat'
    - 'GET /api/chat/conversations'
    - 'GET /api/chat/conversation/{session_id}'
    - 'PATCH /api/chat/conversation/{session_id}'
    - 'DELETE /api/chat/conversation/{session_id}'
    - 'GET /api/chat/conversation/export/{session_id}'
  sources:
  - openapi/sojo-industries-victoria-agent-openapi.json

identity_provider:
  name: Stytch
  evidence: >-
    The Sojo Shield SPA bundle at https://sojoshield.com/assets/index-C2RJOvGT.js embeds the
    Stytch browser SDK (stytch.com/docs/sdks, telemetry.stytch.com, powered_by_stytch logo asset).
    The Victoria OpenAPI info.description names the credential "Stytch session JWT".
  token_resolution: >-
    The Victoria OpenAPI states the bearer token is resolved to an identity via the Shield
    internal endpoint /api/internal/v1/auth/resolve and cached in Redis. That endpoint is internal
    and not part of any public contract.

unauthenticated_surface:
  note: 'These are the only routes reachable with no credential at all, verified 2026-08-28.'
  routes:
  - {url: 'https://victoria-agent.sojoshield.com/openapi.json', status: 200, note: 'The full public OpenAPI'}
  - {url: 'https://victoria-agent.sojoshield.com/mcp', status: 200, note: 'MCP initialize + tools/list succeed anonymously'}
  - {url: 'https://victoria-agent.sojoshield.com/health', status: 200, note: 'Detailed health, including auth_enabled=true and infrastructure internals'}
  - {url: 'https://victoria-agent.sojoshield.com/ready', status: 200}
  - {url: 'https://victoria-agent.sojoshield.com/upload-image', status: null, note: 'Declared in the OpenAPI with no security requirement — not exercised by this pass'}
  - {url: 'https://api.sojoshield.com/docs', status: 200, note: 'Public Swagger UI shell'}

auth_wall:
  host: api.sojoshield.com
  status: 401
  envelope: '{"data":{"message":"No bearer token provided."},"error":{"code":"UNAUTHORIZED","details":{...}}}'
  scope: >-
    Host-wide. Every probed path on api.sojoshield.com returns this 401, including /.well-known/*,
    /graphql, /health and every spec path — the only exceptions are /docs (200, the Swagger UI HTML)
    and /swagger.json (503, "Swagger spec not initialised").

gaps:
- 'No published authentication documentation page — the auth model is only discoverable from the OpenAPI info.description and the SPA bundle.'
- 'No OAuth 2.0 authorization-server or protected-resource metadata at either host.'
- 'No documented scopes or permissions model; the API entry point is tenant-scoped rather than scope-scoped.'
- 'No self-service sign-up or key issuance — access requires a Sojo Shield customer account.'