2X Authentication

generated: '2026-08-13'
method: searched
source: openapi/2x-knownwell-openapi.json
docs: https://api.knownwell.com/docs
note: >-
  2X's API surface (acquired with Knownwell in June 2026) uses two different auth models on
  two different hosts. The REST commercial-intelligence API on api.knownwell.com takes a
  static API key in an X-API-Key header. The remote MCP server on mcp.knownwell.com takes an
  OAuth 2.1 bearer token and publishes full RFC 8414 / RFC 9728 discovery. The OpenAPI
  declares only the first of these, so the OAuth model below was probed from the live
  discovery documents rather than derived from the spec.
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
schemes:
- name: APIKeyHeader
  type: apiKey
  in: header
  parameter: X-API-Key
  applies_to: https://api.knownwell.com/ci/v1
  sources:
  - openapi/2x-knownwell-openapi.json
  description: >-
    Static per-customer API key. Sent on every request as X-API-Key. A missing key returns
    HTTP 401 with body {"detail":"API key is required. Provide it in the X-API-Key header."}
    (observed 2026-08-13). Keys are issued and revoked through the /v1/api-keys operations,
    which are themselves protected by a separate `authorization` header parameter, so there
    is no anonymous self-serve key issuance.
  key_management:
    create: create_api_key_v1_api_keys_post
    list: list_api_keys_v1_api_keys_get
    revoke: revoke_api_key_v1_api_keys__key_id__delete
    scoped: true
    scope_field: scope
    expiry_field: expires_days
- name: KnownwellMCPOAuth
  type: oauth2
  applies_to: https://mcp.knownwell.com/mcp
  method: probed
  sources:
  - well-known/2x-oauth-authorization-server.json
  - well-known/2x-oauth-protected-resource.json
  description: >-
    OAuth 2.1 authorization-code flow with mandatory PKCE, protecting the remote MCP
    endpoint. Supports dynamic client registration, so an MCP client can onboard without a
    pre-provisioned client_id.
  issuer: https://mcp.knownwell.com/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://mcp.knownwell.com/authorize
    tokenUrl: https://mcp.knownwell.com/token
    scopes:
      knownwell.read: Read access to Knownwell commercial-intelligence data
  registration_endpoint: https://mcp.knownwell.com/register
  revocation_endpoint: https://mcp.knownwell.com/revoke
  code_challenge_methods: [S256]
  grant_types: [authorization_code, refresh_token]
  token_endpoint_auth_methods: [client_secret_post, client_secret_basic]
  bearer_methods: [header]
anonymous_surfaces:
- url: https://api.knownwell.com/openapi.json
  note: the OpenAPI document itself is served without authentication
- url: https://api.knownwell.com/health
  note: health check is anonymous
- url: https://2x.com/wp-json/
  note: >-
    the corporate site's WordPress REST API is anonymously readable; WordPress application
    passwords are the documented write-side auth but no anonymous write is exposed
x-evidence:
  fetched: '2026-08-13'
  probes:
  - url: https://api.knownwell.com/v1/clients
    status: 401
    body: '{"detail":"API key is required. Provide it in the X-API-Key header."}'
  - url: https://mcp.knownwell.com/mcp
    status: 401
    www_authenticate: Bearer error="invalid_token"
  - url: https://mcp.knownwell.com/.well-known/oauth-authorization-server
    status: 200