Caterpillar Authentication

generated: '2026-09-05'
method: probed
source: https://fedlogin.cat.com/.well-known/openid-configuration
docs: https://digital.cat.com/knowledge-hub/articles/iso-15143-3-aemp-20-api-developer-guide
note: >-
  Caterpillar publishes no public OpenAPI, so this profile is not derived from a
  spec. It is read from the live OAuth 2.0 / OpenID Connect discovery documents
  served by Caterpillar's own PingFederate authorization server at
  fedlogin.cat.com (HTTP 200, fetched 2026-09-05), cross-checked against the Cat
  Digital ISO 15143-3 developer guide, which names the same token endpoint.
summary:
  types: [oauth2, openIdConnect]
  api_key_in: []
  oauth2_flows: [clientCredentials, authorizationCode, implicit, password, deviceCode, tokenExchange, jwtBearer, saml2Bearer, ciba]
  token_lifetime: 60 minutes
  bearer_token_in: Authorization header
schemes:
  - name: CatDigitalOAuth2
    type: oauth2
    issuer: https://fedlogin.cat.com
    source: https://fedlogin.cat.com/.well-known/openid-configuration
    documented_flow_for_apis: clientCredentials
    flows:
      - flow: clientCredentials
        tokenUrl: https://fedlogin.cat.com/as/token.oauth2
        note: >-
          The flow the Cat Digital developer guides document for API consumers —
          a client id and client secret issued on subscription approval are
          exchanged for an access token that expires after 60 minutes.
      - flow: authorizationCode
        authorizationUrl: https://fedlogin.cat.com/as/authorization.oauth2
        tokenUrl: https://fedlogin.cat.com/as/token.oauth2
      - flow: deviceCode
        deviceAuthorizationUrl: https://fedlogin.cat.com/as/device_authz.oauth2
      - flow: ciba
        backchannelAuthenticationUrl: https://fedlogin.cat.com/as/bc-auth.ciba
  - name: CatDigitalOIDC
    type: openIdConnect
    openIdConnectUrl: https://fedlogin.cat.com/.well-known/openid-configuration
    source: https://fedlogin.cat.com/.well-known/openid-configuration
endpoints:
  issuer: https://fedlogin.cat.com
  authorization: https://fedlogin.cat.com/as/authorization.oauth2
  token: https://fedlogin.cat.com/as/token.oauth2
  revocation: https://fedlogin.cat.com/as/revoke_token.oauth2
  introspection: https://fedlogin.cat.com/as/introspect.oauth2
  userinfo: https://fedlogin.cat.com/idp/userinfo.openid
  jwks: https://fedlogin.cat.com/pf/JWKS
  registration: https://fedlogin.cat.com/as/clients.oauth2
  pushed_authorization_request: https://fedlogin.cat.com/as/par.oauth2
  device_authorization: https://fedlogin.cat.com/as/device_authz.oauth2
  backchannel_authentication: https://fedlogin.cat.com/as/bc-auth.ciba
  end_session: https://fedlogin.cat.com/idp/init_logout.openid
capabilities:
  pkce: [plain, S256]
  dynamic_client_registration: true
  pushed_authorization_requests: supported
  require_pushed_authorization_requests: false
  dpop_signing_algs: [RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, none]
  mtls_client_auth: true
  token_exchange: true
  request_object_signing: true
  request_uri_parameter_supported: false
  authorization_response_iss_parameter_supported: false
  backchannel_logout: true
  frontchannel_logout: true
claims_supported:
  - catafltnclass
  - catafltncode
  - catcupid
  - catloginid
  - displayName
  - givenName
  - mail
  - sn
  - sub
  - telephonenumber
gaps:
  - >-
    token_endpoint_auth_methods_supported advertises `none`, and
    id_token_signing_alg_values_supported advertises `none` — both are
    PingFederate defaults rather than anything Caterpillar documents, but they
    are what the discovery document actually says.
  - >-
    code_challenge_methods_supported still advertises `plain` alongside `S256`.
  - >-
    No /.well-known/oauth-protected-resource (RFC 9728) is served on any host, so
    an agent holding a token cannot discover the resource server from metadata.