Cloud Commerce Authentication

generated: '2026-08-13'
method: probed
source: https://openapi.fastship.co/api/v2/login
note: PROBED, NOT DERIVED. Cloud Commerce publishes no OpenAPI and no public authentication reference, so derive-authentication.py
  had nothing to read. This profile is built entirely from anonymous live requests against the FastShip Open API host, and
  records only what those responses actually proved. No scheme, header name, token lifetime or scope is asserted that was
  not observed.
apis:
- name: FastShip Open API
  baseURL: https://openapi.fastship.co/api/v2
  schemes:
  - &id001
    id: login_token
    type: http
    style: bearer-token-via-credential-exchange
    confidence: medium
    observed: true
    token_endpoint: https://openapi.fastship.co/api/v2/login
    token_endpoint_methods:
    - GET
    - HEAD
    - POST
    grant: password
    credentials:
    - field: email
      required: true
      evidence: POST {} returned 400 with data.error.email = ["The email field is required."]
    - field: password
      required: true
      evidence: POST {} returned 400 with data.error.password = ["The password field is required."]
    purpose_stated_by_provider: For logged in and generate Token.
    note: The endpoint's own 400 body states its purpose is "For logged in and generate Token." A bad-credential POST returns
      401 with "Email or Password incorrect." The response header name that carries the issued token, its lifetime, its refresh
      mechanism and the header an authenticated call must send are NOT public and were NOT probed — issuing a token would
      require real credentials, which this pipeline never uses.
evidence:
- url: https://openapi.fastship.co/api/v2
  method: GET
  status: 200
  body: Welcome to API Version 2.0
- url: https://openapi.fastship.co/api/v2/login
  method: GET
  status: 401
  body: '{"message":"failed","description":"Login failed","data":[]}'
- url: https://openapi.fastship.co/api/v2/login
  method: POST
  status: 400
  note: empty JSON body; returned per-field validation errors for email and password
- url: https://openapi.fastship.co/api/v2/login
  method: POST
  status: 401
  note: syntactically valid but non-existent credentials; "Email or Password incorrect."
- url: https://openapi.fastship.co/api/v2/login
  method: OPTIONS
  status: 200
  allow: GET,HEAD,POST
gaps:
- no OpenAPI or Swagger document is published on any Cloud Commerce host
- no public authentication reference page
- no /.well-known/openid-configuration or /.well-known/oauth-authorization-server on any host, so this is not an OAuth or
  OIDC surface
- 'the authenticated request header (Authorization: Bearer vs a custom header) is undocumented and unverifiable without credentials'
schemes:
- *id001