Aerin Medical Authentication

generated: '2026-07-31'
method: derived
probe: true
source: openapi/aerin-medical-site-openapi.yml + live probes of https://aerinmedical.com/wp-json
docs: null
summary:
  types: [none, http]
  api_key_in: []
  oauth2_flows: []
  public_credential_available: false
  anonymous_access: true
model: >-
  Aerin Medical has no developer authentication story: no sign-up, no API keys, no OAuth, no
  OIDC, no scopes, no tokens, and no documented auth page. The only scheme the platform
  advertises is WordPress application passwords, which are issued by the site's own
  administrators and are not obtainable by the public. Every operation catalogued in openapi/
  is reachable ANONYMOUSLY with no credential; the routes that are NOT reachable are blocked
  outright at the edge rather than gated behind an obtainable credential.
schemes:
- name: anonymous
  type: none
  description: >-
    No credential required. All 15 catalogued operations — the doctor-finder collection, the
    locator widget, site search, oEmbed, the route-discovery documents, the footer, and the
    seven aerin-namespace form POSTs — accept unauthenticated requests. CORS is fully open
    (Access-Control-Allow-Origin: *), so browser callers on any origin can reach them.
  sources: [openapi/aerin-medical-site-openapi.yml]
  evidence:
    fetched: '2026-07-31'
    observed: HTTP 200 on every catalogued read operation with no Authorization header.
- name: applicationPassword
  type: http
  scheme: basic
  description: >-
    WordPress application passwords, advertised by the site's own route index at
    authentication.application-passwords.endpoints.authorization. This is the built-in
    WordPress mechanism for authenticated calls and exists on every WordPress install; it is
    not an Aerin Medical developer programme.
  authorization_endpoint: https://aerinmedical.com/wp-admin/authorize-application.php
  publicly_obtainable: false
  sources: [openapi/aerin-medical-site-openapi.yml, 'https://aerinmedical.com/wp-json/']
restricted_surface:
  mechanism: iThemes Security plugin (route-level restriction)
  status: 401
  code: itsec_rest_api_access_restricted
  affected:
  - /wp/v2/posts
  - /wp/v2/pages
  - /wp/v2/media
  - /wp/v2/categories
  - /wp/v2/tags
  - /wp/v2/users
  - /wp/v2/comments
  - /wp/v2/types
  - /wp/v2/taxonomies
  - /wp/v2/statuses
  - /wp/v2/blocks
  - /wp/v2/navigation
  note: >-
    Unusually for a WordPress site the content collections are closed while the company's own
    custom plugin routes are wide open. The posture is inverted relative to data sensitivity:
    the closed routes hold public marketing copy, while the open locator route returns
    internal CRM fields — see security/aerin-medical-domain-security.yml, exposures[].
not_present:
  oauth2: /.well-known/oauth-authorization-server returns 404 on every host
  oidc: /.well-known/openid-configuration returns 404 on every host
  api_keys: no key issuance, no developer sign-up, no key header documented or observed
  mtls: not offered
  scopes: no scope surface exists, so scopes/ was deliberately not written