Alcohol And Tobacco Tax And Trade Bureau Authentication

generated: '2026-09-01'
method: searched
source: https://www.ttb.gov/data
docs: https://www.ttb.gov/regulated-commodities/labeling/cola-public-registry
note: >-
  Derived by search, not from a spec — TTB publishes no OpenAPI, so there are no
  securitySchemes to aggregate. The auth model is nonetheless well-defined and worth recording:
  TTB's machine-readable open data is entirely anonymous and issues no credentials of any kind,
  while its two transactional web applications are session-login only with no programmatic
  access path.
summary:
  types: [none, session-login]
  api_key_in: []
  oauth2_flows: []
  api_keys_issued: false
  registration_required_for_data: false
schemes:
  - name: anonymous-public-data
    type: none
    applies_to:
      - TTB Open Data files (XML / CSV / JSON)
      - TTB Public COLA Registry read access
    evidence: >-
      https://www.ttb.gov/images/foia/cola_stats.xml and
      https://www.ttb.gov/images/foia/form_stats.csv both return HTTP 200 with no
      Authorization header, no cookie and no API key (probed 2026-09-01). The COLA Public
      Registry page states no registration or password is required to use it.
    sources: [https://www.ttb.gov/regulated-commodities/labeling/cola-public-registry]
  - name: ttb-online-session-login
    type: session
    scheme: form-login
    applies_to:
      - Permits Online (PONL)
      - COLAs Online (filing)
      - Formulas Online (FONL)
    login_url: https://www.ttbonline.gov/permitsonline/
    evidence: >-
      TTB Online applications require a registered TTB.gov user account and are entered through
      a form login at https://www.ttbonline.gov/permitsonline/. No token, key or OAuth endpoint
      is documented; /.well-known/oauth-authorization-server and
      /.well-known/openid-configuration are not served on www.ttb.gov (404 each).
    programmatic_access: false
    sources: [https://www.ttb.gov/online-services/ponl/permits-online-help]
absent:
  - api_key
  - bearer_token
  - oauth2
  - openid_connect
  - mutual_tls
  - hmac_signing