Bioaegis Therapeutics Authentication

generated: '2026-08-07'
method: probed
source: >-
  Live anonymous probes of https://www.bioaegistherapeutics.com/wp-json/ plus the WordPress REST
  route index, 2026-08-07. BioAegis Therapeutics publishes no authentication documentation of its
  own.
api: bioaegis-therapeutics-content-api
summary: >-
  The BioAegis Therapeutics content API declares exactly one authentication provider, and it is not
  usable by a third party. The REST index at /wp-json/ returns
  `"authentication": {"application-passwords": {"endpoints": {"authorization":
  "https://www.bioaegistherapeutics.com/wp-admin/authorize-application.php"}}}` — WordPress
  application passwords, whose authorization endpoint requires an existing wp-admin login. The 23
  read operations catalogued in this repo require no credentials at all. Everything else — writes,
  users, settings, menus, themes, plugins, templates, revisions, the wp-abilities/v1 capability
  registry, wp-site-health/v1, wp-block-editor/v1, redirection/v1 and the administrative half of
  yoast/v1 — is refused anonymously, and the only credential paths are a logged-in WordPress
  session cookie plus an X-WP-Nonce, or an application password issued from wp-admin. Neither is
  obtainable by a third party and neither is documented publicly, so no usable scheme is asserted
  here.
schemes:
- id: application-passwords
  type: http
  scheme: basic
  usable_by_third_party: false
  advertised_at: https://www.bioaegistherapeutics.com/wp-json/
  authorization_endpoint: https://www.bioaegistherapeutics.com/wp-admin/authorize-application.php
  note: >-
    Advertised in the REST index, but the authorization endpoint is behind wp-admin. There is no
    self-service signup, no OAuth flow, no API key issuance and no developer account of any kind.
    Recorded because the provider advertises it, not because it is reachable.
observed:
- surface: read operations in openapi/bioaegis-therapeutics-content-openapi.yml
  auth_required: false
  evidence: 'All 23 modelled operations returned HTTP 200 with no Authorization header on 2026-08-07.'
- surface: /wp/v2/users, /wp/v2/users/me
  auth_required: true
  status: 403
  code: null
  evidence: >-
    Blocked at the edge by the Sucuri CloudProxy WAF, which answers with an HTML interstitial
    (cdn.sucuri.net stylesheets) rather than a WordPress JSON error. This is the only operation on
    the surface whose failure response is not JSON — a client parsing every response as JSON will
    throw here rather than read an error code.
- surface: /wp/v2/settings
  auth_required: true
  status: 401
  code: rest_forbidden
- surface: /wp/v2/menus, /wp/v2/menu-items, /wp/v2/menu-locations
  auth_required: true
  status: 401
  code: rest_cannot_view
- surface: /wp/v2/themes
  auth_required: true
  status: 401
  code: rest_cannot_view_themes
- surface: /wp/v2/plugins
  auth_required: true
  status: 401
  code: rest_cannot_view_plugins
- surface: /wp/v2/templates, /wp/v2/template-parts
  auth_required: true
  status: 401
  code: rest_cannot_manage_templates
- surface: /wp/v2/global-styles/themes/astra
  auth_required: true
  status: 401
  code: rest_cannot_read_global_styles
- surface: /wp/v2/block-types
  auth_required: true
  status: 401
  code: rest_block_type_cannot_view
- surface: /wp/v2/block-patterns/categories
  auth_required: true
  status: 401
  code: rest_cannot_view
- surface: /wp/v2/pattern-directory/patterns
  auth_required: true
  status: 401
  code: rest_pattern_directory_cannot_view
- surface: /wp/v2/sidebars, /wp/v2/widget-types
  auth_required: true
  status: 401
  code: rest_cannot_manage_widgets
- surface: /wp/v2/font-collections
  auth_required: true
  status: 401
  code: rest_cannot_read
- surface: /wp/v2/posts/{id}/revisions
  auth_required: true
  status: 401
  code: rest_cannot_read
- surface: /oembed/1.0/proxy
  auth_required: true
  status: 401
  code: rest_forbidden
  note: The oEmbed provider endpoint (/oembed/1.0/embed) is anonymous; only the third-party proxy is gated.
- surface: /yoast/v1/available_posts
  auth_required: true
  status: 401
  code: rest_forbidden
  note: >-
    52 of the 53 yoast/v1 routes are administrative. Only /yoast/v1/get_head answers anonymously.
- surface: /wp-site-health/v1/*
  auth_required: true
  status: 401
  code: rest_forbidden
- surface: /wp-block-editor/v1/export
  auth_required: true
  status: 401
  code: rest_cannot_export_templates
- surface: /redirection/v1/redirect
  auth_required: true
  status: 401
  code: rest_forbidden
- surface: /wp-abilities/v1/abilities, /wp-abilities/v1/categories
  auth_required: true
  status: 401
  code: rest_forbidden
  note: >-
    The WordPress Abilities API — an agent-facing capability registry — is registered on this
    deployment but every endpoint under it, including the read-only /abilities and /categories
    listings, refuses anonymous callers. The namespace index /wp-abilities/v1 itself returns 200
    with route metadata only. No agent surface is claimed for this provider.
- surface: /elementor/v1/globals
  auth_required: unknown
  status: 500
  note: Returns a server error rather than an auth error anonymously.
- surface: /astra/v1/get-sites
  auth_required: unknown
  status: 502
  note: Returns a bad-gateway from the WAF/origin rather than an auth error anonymously.
transport:
  https_only: true
  tls_version: TLSv1.3
  hsts: false
  note: >-
    HTTPS is enforced and TLS 1.3 negotiates, but no Strict-Transport-Security header is served on
    the API host, so a first-contact downgrade is not prevented. See
    security/bioaegis-therapeutics-domain-security.yml.
docs: null
docs_note: >-
  BioAegis Therapeutics publishes no authentication documentation for this surface. The upstream
  contract is defined by the WordPress REST handbook at
  https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/.