generated: '2026-09-05'
method: probed
source: >-
  https://login.zartico.com/.well-known/openid-configuration (200),
  https://login.zartico.com/.well-known/oauth-authorization-server (200),
  https://platform.zartico.com/.well-known/openid-configuration (200),
  https://platform.zartico.com/.well-known/oauth-authorization-server (200),
  https://geoserver.zartico.com/geoserver/ows?service=WMS&request=GetCapabilities (200, anonymous),
  https://geoserver.zartico.com/geoserver/rest (401),
  https://www.zartico.com/security (200)
note: |
  Zartico publishes no developer authentication guide, no API-key issuance flow and no token
  documentation. Everything below was read from live discovery documents and live probe
  responses, not from prose. Two distinct auth postures coexist on the estate.
schemes:
  - id: okta-oidc-login
    type: openIdConnect
    surface: Zartico Identity (login.zartico.com)
    openIdConnectUrl: https://login.zartico.com/.well-known/openid-configuration
    issuer: https://login.zartico.com
    provider: Okta
    endpoints:
      authorization: https://login.zartico.com/oauth2/v1/authorize
      token: https://login.zartico.com/oauth2/v1/token
      userinfo: https://login.zartico.com/oauth2/v1/userinfo
      jwks: https://login.zartico.com/oauth2/v1/keys
      introspection: https://login.zartico.com/oauth2/v1/introspect
      revocation: https://login.zartico.com/oauth2/v1/revoke
      end_session: https://login.zartico.com/oauth2/v1/logout
      device_authorization: https://login.zartico.com/oauth2/v1/device/authorize
      registration: https://login.zartico.com/oauth2/v1/clients
      pushed_authorization_request: advertised
    grant_types:
      - authorization_code
      - implicit
      - refresh_token
      - password
      - client_credentials
      - urn:ietf:params:oauth:grant-type:device_code
      - urn:openid:params:grant-type:ciba
      - urn:okta:params:oauth:grant-type:otp
      - urn:okta:params:oauth:grant-type:oob
    pkce:
      supported: true
      methods: [S256]
    token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
      - client_secret_jwt
      - private_key_jwt
      - none
    id_token_signing_alg: [RS256]
    id_token_encryption_alg: [RSA-OAEP-256, RSA-OAEP-384, RSA-OAEP-512]
    dpop_signing_algs: [RS256, RS384, RS512, ES256, ES384, ES512]
    dynamic_client_registration: true
    note: >-
      Dynamic client registration and the introspection/revocation endpoints are advertised in the
      discovery document. They were NOT exercised - this record asserts only what the document
      declares.
  - id: okta-oidc-platform
    type: openIdConnect
    surface: Zartico Platform (platform.zartico.com)
    openIdConnectUrl: https://platform.zartico.com/.well-known/openid-configuration
    issuer: https://platform.zartico.com
    provider: Okta
    endpoints:
      authorization: https://platform.zartico.com/oauth2/v1/authorize
      token: https://platform.zartico.com/oauth2/v1/token
      userinfo: https://platform.zartico.com/oauth2/v1/userinfo
      jwks: https://platform.zartico.com/oauth2/v1/keys
      introspection: https://platform.zartico.com/oauth2/v1/introspect
      revocation: https://platform.zartico.com/oauth2/v1/revoke
      end_session: https://platform.zartico.com/oauth2/v1/logout
      device_authorization: https://platform.zartico.com/oauth2/v1/device/authorize
      registration: https://platform.zartico.com/oauth2/v1/clients
    grant_types:
      - authorization_code
      - implicit
      - refresh_token
      - password
      - client_credentials
      - urn:ietf:params:oauth:grant-type:device_code
    pkce:
      supported: true
      methods: [S256]
    token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
      - client_secret_jwt
      - private_key_jwt
      - none
    id_token_signing_alg: [RS256]
    dpop_signing_algs: [RS256, RS384, RS512, ES256, ES384, ES512]
    dynamic_client_registration: true
    note: >-
      A narrower authorization server than login.zartico.com - no CIBA, no Okta OOB/OTP grants,
      no pushed authorization request endpoint advertised.
  - id: ogc-anonymous
    type: none
    surface: Zartico GeoServer OGC Web Services (geoserver.zartico.com)
    note: >-
      The OGC read surface requires NO authentication. GetCapabilities for WMS 1.3.0, WFS 2.0.0
      and WCS 2.0.1 all returned HTTP 200 to an anonymous, unauthenticated request, and both the
      WMS and WCS capabilities documents declare Fees "none" and AccessConstraints "none".
  - id: geoserver-rest-admin
    type: http
    scheme: basic
    surface: GeoServer REST configuration API (geoserver.zartico.com/geoserver/rest)
    note: >-
      https://geoserver.zartico.com/geoserver/rest returned HTTP 401 Unauthorized to an anonymous
      request. This is GeoServer's built-in administrative REST API, which is protected. It was
      probed once, unauthenticated, and not pursued further - no credentials of any kind were
      used or attempted.
observations:
  - >-
    No API key, bearer token or personal-access-token issuance is documented anywhere on
    www.zartico.com or support.zartico.com.
  - >-
    https://www.zartico.com/security states that hardware 2-factor authentication is required for
    all Zartico staff and that customer dashboards and portals are password-protected. It
    documents no customer-facing API authentication.