Ameren Authentication

generated: '2026-09-02'
method: probed
source: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration
docs: https://www.ameren.com/partners/account-and-data/share-my-usage
provider: Ameren
providerId: ameren
description: >-
  Ameren publishes no OpenAPI, so this profile is not derived from a spec. It is read from
  two real sources: (1) the live, anonymous OpenID Connect discovery document served by
  Ameren's ForgeRock AM enterprise identity service (eiam = Enterprise Identity and Access
  Management) at login.eiam.ece.ameren.com, and (2) Ameren Illinois' own Share My Usage
  program page, which states the program uses the Green Button Connect My Data APIs with
  OAuth customer authorization and that Aclara is the authorized data custodian.
ownership: >-
  The discovery document's issuer and every advertised endpoint are on
  global.login.eiam.ameren.com — an ameren.com host — so this identity surface belongs to
  Ameren and not to a vendor tenant.
schemes:
  - id: ameren_eiam_oidc
    type: openIdConnect
    name: Ameren Enterprise IAM (ForgeRock AM)
    openIdConnectUrl: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration
    issuer: https://global.login.eiam.ameren.com/am/oauth2
    endpoints:
      authorization: https://global.login.eiam.ameren.com/am/oauth2/authorize
      token: https://global.login.eiam.ameren.com/am/oauth2/access_token
      userinfo: https://global.login.eiam.ameren.com/am/oauth2/userinfo
      jwks: https://global.login.eiam.ameren.com/am/oauth2/connect/jwk_uri
      introspection: https://global.login.eiam.ameren.com/am/oauth2/introspect
      revocation: https://global.login.eiam.ameren.com/am/oauth2/token/revoke
      registration: https://global.login.eiam.ameren.com/am/oauth2/register
      pushed_authorization_request: https://global.login.eiam.ameren.com/am/oauth2/par
      end_session: https://global.login.eiam.ameren.com/am/oauth2/connect/endSession
      check_session_iframe: https://global.login.eiam.ameren.com/am/oauth2/connect/checkSession
    grant_types:
      - authorization_code
      - implicit
      - refresh_token
      - password
      - client_credentials
      - urn:ietf:params:oauth:grant-type:device_code
      - urn:ietf:params:oauth:grant-type:saml2-bearer
      - urn:ietf:params:oauth:grant-type:uma-ticket
    response_types:
      - code
      - token
      - id_token
      - code id_token
      - code token
      - token id_token
      - code token id_token
      - device_code
    token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
      - private_key_jwt
      - tls_client_auth
      - self_signed_tls_client_auth
      - none
    pkce:
      supported: true
      code_challenge_methods: [S256, plain]
    mutual_tls:
      client_auth: true
      certificate_bound_access_tokens: false
    pushed_authorization_requests:
      supported: true
      required: false
    id_token_signing_algs: [RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, HS256, HS384, HS512]
    subject_types: [public]
    claims: [name, given_name, family_name, email, phone_number, address, profile, locale, zoneinfo]
    caveat: >-
      The advertised endpoint host global.login.eiam.ameren.com does not resolve publicly.
      The discovery document is anonymously readable; the endpoints it names are not
      publicly reachable. Treat the endpoint list as declared configuration, not as a
      callable public surface.
  - id: green_button_oauth
    type: oauth2
    name: Green Button Connect My Data (Share My Usage) customer authorization
    method: searched
    source: https://www.ameren.com/partners/account-and-data/share-my-usage
    description: >-
      Ameren Illinois' Share My Usage program follows the NAESB/ESPI Green Button Connect
      My Data profile: the customer signs in to their Ameren Illinois online account and
      authorizes a registered third party, which then retrieves up to 24 months of
      historical and 24 months of forward electric usage data as ESPI XML. Ameren Illinois'
      page states the technical requirements are "consistent with those defined in the
      standard Green Button Connect Application Programming Interfaces."
    endpoints_published: false
    endpoints_note: >-
      NEITHER Ameren nor Aclara publishes the OAuth authorize/token URLs or the ESPI
      resource base for this program on any public page. They are handed to a third party
      by Aclara during the 2-4 week registration. The canonical Green Button DataCustodian
      resource path was probed on gp.ameren.com and returned the site's HTML bot-challenge
      page, not an ESPI Atom feed.
    onboarding:
      registration_url: https://gp.ameren.com/third-party-registration/instructions
      registration_guide_pdf: https://www.ameren.com/-/media/files/resources-and-support/account-and-data/share-usage/third-party-share-my-usage-registration-guide-2019.ashx
      contact: IllinoisBusinessApplications@ameren.com
      duration: 2 to 4 weeks
      custodian: Aclara
      territory: Illinois only — not available to Missouri customers
api_key_support: false
mutual_tls_only: false
evidence:
  - url: https://login.eiam.ece.ameren.com/am/oauth2/.well-known/openid-configuration
    status: 200
    kind: OIDC discovery document (anonymous)
  - url: https://login.eiam.ece.ameren.com/am/oauth2/connect/jwk_uri
    status: 200
    kind: JWKS
  - url: https://login.eiam.ece.ameren.com/.well-known/openid-configuration
    status: 404
    kind: RFC 8414 root path (not served)
  - url: https://www.ameren.com/partners/account-and-data/share-my-usage
    status: 200
    kind: program documentation
  - url: https://gp.ameren.com/DataCustodian/espi/1_1/resource/ApplicationInformation
    status: 200
    kind: MISS — HTML bot-challenge page, not ESPI
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com