Aristamd Authentication

generated: '2026-08-06'
method: probed
source: >-
  Anonymous live probes of https://api.aristamd.com — the published Swagger 2.0
  definition at /api-docs declares NO securityDefinitions and NO security
  requirements, so nothing here is derived from the spec. Every fact below is an
  observed HTTP response recorded on 2026-08-06.

summary:
  types: [oauth2, saml2]
  api_key_in: []
  oauth2_flows: [authorizationCode, clientCredentials, password, refreshToken]
  spec_declares_auth: false
  note: >-
    This is a documentation gap, not an absence of authentication. The Swagger
    document ships zero securityDefinitions, so a machine reading only the spec
    would conclude the API is open. It is not: all 32 documented paths return
    401 without credentials. The real auth model had to be recovered by probing.

# ---------------------------------------------------------------------------
# What the spec says
# ---------------------------------------------------------------------------
spec:
  file: openapi/aristamd-openapi-original.json
  swagger: '2.0'
  securityDefinitions: null
  security: null
  header_parameters_declared: 0
  gap: >-
    No securityDefinitions object, no global `security`, and not one operation
    declares an Authorization header parameter. Adding a single
    securityDefinitions entry plus a global security requirement would make the
    contract self-describing for SDK generators and agents.

# ---------------------------------------------------------------------------
# What the running service actually does
# ---------------------------------------------------------------------------
schemes:
- name: oauth2
  type: oauth2
  method: probed
  server: Laravel Passport (league/oauth2-server) — inferred from the RFC 6749
    error envelope, which carries the league/oauth2-server `hint` and `message`
    fields alongside the standard `error`/`error_description` pair.
  token_url: https://api.aristamd.com/oauth/token
  authorization_url: https://api.aristamd.com/oauth/authorize
  discovery:
    oauth_authorization_server: 404
    oauth_protected_resource: 404
    openid_configuration: 404
    note: >-
      No RFC 8414 / RFC 9728 / OIDC discovery document is published. The
      endpoints below were found by direct probe, not by discovery.
  grant_types_supported:
  # Determined by POSTing each grant_type with no other parameters and reading
  # which RFC 6749 error came back. `invalid_request` means the server knows the
  # grant and is asking for the missing parameters; `unsupported_grant_type`
  # means it does not implement it. No credentials were used or guessed.
  - grant: authorization_code
    supported: true
    evidence: 'POST /oauth/token grant_type=authorization_code -> 400 invalid_request'
  - grant: client_credentials
    supported: true
    evidence: 'POST /oauth/token grant_type=client_credentials -> 400 invalid_request'
  - grant: password
    supported: true
    evidence: 'POST /oauth/token grant_type=password -> 400 invalid_request'
  - grant: refresh_token
    supported: true
    evidence: 'POST /oauth/token grant_type=refresh_token -> 400 invalid_request'
  - grant: implicit
    supported: false
    evidence: 'POST /oauth/token grant_type=implicit -> 400 unsupported_grant_type'
  - grant: urn:ietf:params:oauth:grant-type:jwt-bearer
    supported: false
    evidence: 'POST /oauth/token grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
      -> 400 unsupported_grant_type'
  scopes:
    published: false
    note: >-
      No scope reference is published and the Swagger document carries no scope
      map, so no scopes/ artifact is emitted. Whether this deployment uses
      Passport scopes at all cannot be determined anonymously.

- name: saml2
  type: saml2
  method: probed
  role: service-provider
  metadata_url: https://api.aristamd.com/saml2/metadata
  metadata_file: aristamd-saml2-metadata.xml
  entity_id: https://api.aristamd.com/saml2/metadata
  assertion_consumer_service:
    binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
    location: https://api.aristamd.com/saml2/acs
    index: 1
  single_logout_service:
    binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
    location: https://api.aristamd.com/saml2/sls
  name_id_format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
  authn_requests_signed: false
  want_assertions_signed: false
  technical_contact: support@aristamd.com
  evidence: 'GET /saml2/metadata -> 200 text/xml, 1622 bytes, valid SAML 2.0
    EntityDescriptor'
  note: >-
    A real, machine-readable federation artifact — this is how an identity
    provider at a health plan or health system would federate clinicians into
    AristaMD. Worth flagging that the SP advertises AuthnRequestsSigned="false"
    and WantAssertionsSigned="false"; for a HIPAA-regulated workload most
    identity teams would expect signed assertions to be required.

# ---------------------------------------------------------------------------
# Observed enforcement
# ---------------------------------------------------------------------------
enforcement:
  unauthenticated_response:
    status: 401
    body: '{"message":"Unauthorized"}'
    content_type: application/json
  paths_probed_anonymously: [/econsults, /users, /panelists, /reviews, /comments,
    /workup-checklists/specialties, '/specialties/withAvailablePanelists/{filter}']
  result: >-
    All returned 401. Undocumented control paths (/NOT-A-REAL-PATH, /foo/bar)
    returned 404 with a different body, which confirms the 401s are real
    authentication rejections on routed endpoints and not a catch-all.
  anomaly:
    path: /patients
    status: 500
    body: '{"message":"An error has occurred while processing your request"}'
    note: >-
      GET /patients returns 500 rather than 401 when called anonymously. The
      handler appears to dereference the authenticated user before the auth
      middleware rejects the request. No data was returned; recorded as an
      observation for the provider, not as an access finding.

docs:
  published: false
  note: >-
    No public authentication documentation was found. www.aristamd.com has no
    developer or API section (/developers, /api both 404), and app.aristamd.com,
    developer.aristamd.com and help.aristamd.com are all the same Angular
    single-page app, which answers 200 with an identical 1820-byte shell for
    every path including control paths.

x-evidence:
  fetched: '2026-08-06'
  probes:
  - {url: 'https://api.aristamd.com/api-docs', status: 200}
  - {url: 'https://api.aristamd.com/oauth/token', status: 400}
  - {url: 'https://api.aristamd.com/oauth/authorize', status: 401}
  - {url: 'https://api.aristamd.com/saml2/metadata', status: 200}
  - {url: 'https://api.aristamd.com/econsults', status: 401}
  - {url: 'https://api.aristamd.com/.well-known/oauth-authorization-server', status: 404}
  - {url: 'https://api.aristamd.com/.well-known/openid-configuration', status: 404}