Cornerstone Building Brands Authentication

generated: '2026-09-19'
method: probed
source: >-
  https://www.cornerstonebuildingbrands.com/.well-known/oauth-authorization-server,
  https://www.cornerstonebuildingbrands.com/.well-known/oauth-protected-resource, and live 200/401
  responses observed on www.cornerstonebuildingbrands.com/wp-json on 2026-09-19
docs: null
description: >-
  Two authentication postures on one host. The wp/v2 content read surface is anonymous — posts, pages,
  media, news, industry, leadership, categories, tags, news_category, news_solution, search, taxonomies,
  types and statuses all return HTTP 200 with no credential — while the MCP server routes, the WordPress
  Abilities registry and every administrative WordPress route (settings, menus, menu-items, block-types)
  require a bearer token or a WordPress session and answer 401. Probed rather than derived: the derived
  Content API declares no securitySchemes because its documented operations need none, so a spec-only
  derivation would have recorded "no authentication" and missed the OAuth server entirely. The company
  publishes no authentication documentation of its own; everything here is read from the discovery
  documents and observed responses. The separate Customer Portal (portal.cornerstonebuildingbrands.com)
  signs in with Microsoft Entra ID (MSAL) — observed in the portal's public JavaScript bundle, not
  documented — and is out of scope for this profile.
summary:
  types: [none, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  anonymous_read: true
  pkce: S256
  dynamic_client_registration: false
schemes:
- name: none
  type: none
  applies_to: openapi/cornerstone-building-brands-content-api-openapi.yml
  description: >-
    The documented wp/v2 read operations require no credential. Verified anonymously on 2026-09-19 across
    all 14 collections in the derived spec (HTTP 200 each).
  sources:
  - https://www.cornerstonebuildingbrands.com/wp-json/wp/v2/news?per_page=2
- name: OAuth2
  type: oauth2
  applies_to: https://www.cornerstonebuildingbrands.com/wp-json/mcp/mcp-oauth-server
  description: >-
    OAuth 2.1 authorization code with PKCE (S256), public clients (token_endpoint_auth_methods_supported
    ["none"]), client-ID metadata documents in place of dynamic registration, single `mcp` scope, bearer
    token in the Authorization header. The 401 challenge carries a WWW-Authenticate header whose
    resource_metadata points at the RFC 9728 protected-resource document — the RFC 9728 discovery loop
    working as specified.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://www.cornerstonebuildingbrands.com/oauth/authorize
    tokenUrl: https://www.cornerstonebuildingbrands.com/oauth/token
    revocationUrl: https://www.cornerstonebuildingbrands.com/oauth/revoke
    refreshUrl: https://www.cornerstonebuildingbrands.com/oauth/token
    scopes: [mcp]
  sources:
  - https://www.cornerstonebuildingbrands.com/.well-known/oauth-authorization-server
  - https://www.cornerstonebuildingbrands.com/.well-known/oauth-protected-resource
x-evidence:
  fetched: '2026-09-19'
  probes:
  - url: https://www.cornerstonebuildingbrands.com/wp-json/wp/v2/posts?per_page=2
    status: 200
  - url: https://www.cornerstonebuildingbrands.com/wp-json/wp/v2/settings
    status: 401
  - url: https://www.cornerstonebuildingbrands.com/wp-json/mcp/mcp-oauth-server
    method: POST tools/list
    status: 401
    www_authenticate: 'Bearer realm="https://www.cornerstonebuildingbrands.com", resource_metadata="https://www.cornerstonebuildingbrands.com/.well-known/oauth-protected-resource"'
  - url: https://www.cornerstonebuildingbrands.com/oauth/token
    method: POST (empty)
    status: 400
    body: '{"error":"unsupported_grant_type"}'
  - url: https://www.cornerstonebuildingbrands.com/oauth/register
    status: 404