Cosmose Ai Authentication

generated: '2026-08-11'
method: derived
source: openapi/cosmose-ai-deal-hunter-registration-api-openapi.yml
note: >-
  Derived from the provider's own published OpenAPI plus observed live gateway responses. Cosmose AI publishes no
  developer authentication documentation — there is no developer portal, no API reference page and no key-issuance
  flow a member of the public can reach — so everything below comes from the contract and from probing.
summary:
  types:
  - http
  primary: bearer JWT
  scheme_count: 1
  applied_globally: true
  developer_docs_published: false
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  applied: global
  detail: >-
    Declared once in components.securitySchemes and applied at the document root (`security: [{bearerAuth: []}]`), so
    every one of the 24 operations inherits it — including the public-facing lead-capture endpoints
    (/v1/contact-forms, /v1/newsletter, /v1/merchants, /v1/schools) that the marketing site posts to from an
    unauthenticated browser. The contract therefore over-declares auth relative to observed behaviour; the spec does
    not distinguish the anonymous endpoints from the authenticated ones.
  sources:
  - openapi/cosmose-ai-deal-hunter-registration-api-openapi.yml
token_endpoints:
- operationId: generateTokens
  method: POST
  path: /v2/token
  description: >-
    OAuth-2-shaped but not OAuth 2.0 — parameters are named `grant_type` (required), `refresh_token` and `scope`
    (default value `kaikai`), yet they are carried as QUERY parameters rather than an
    application/x-www-form-urlencoded body, no securityScheme of type oauth2 is declared, and no authorization or
    discovery endpoint is published. Returns a TokenInfo object with `access_token`, `refresh_token`, `type` and
    `expires_in`.
  additional_inputs:
  - name: Installation-Id
    in: header
    detail: Device/installation identifier, optional in the contract, used to bind tokens to an app installation.
- operationId: generateTokens_1
  method: POST
  path: /v2/crucible-token
  description: >-
    Second token issuer under an internal product codename ("crucible"), same TokenInfo response shape. Undocumented
    publicly; its relationship to /v2/token is not described in the contract.
oauth2:
  declared: false
  discovery:
    openid_configuration: false
    oauth_authorization_server: false
  note: >-
    Probed /.well-known/openid-configuration and /.well-known/oauth-authorization-server on cosmose.ai, cosmose.co,
    kaikai.ai, api.cosmose.co, api.sg.cosmose.co and repo.cosmose.co on 2026-08-11. The web hosts answer HTTP 200
    with the Angular single-page-app shell for every path (byte-identical to the homepage — a soft 200, not a
    document); the API gateways answer 401; repo.cosmose.co answers 404. No discovery document exists.
gateway_behaviour:
  probed: '2026-08-11'
  observations:
  - host: api.cosmose.co
    path: /
    status: 401
    body: '{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}'
  - host: api.sg.cosmose.co
    path: /
    status: 401
    body: '{"error":"unauthorized","error_description":"Full authentication is required to access this resource"}'
  - host: api.sg.cosmose.co
    path: /deal-hunter-registration-api/v3/api-docs
    status: 200
    body: OpenAPI 3.0.1 document, served anonymously
  note: >-
    The gateway's own 401 envelope (`error` / `error_description`) is a different error shape from the ErrorDto
    (`errorCode` / `message`) the service returns, and neither 401 nor the gateway envelope appears anywhere in the
    published contract. See errors/cosmose-ai-problem-types.yml.
key_issuance:
  self_serve: false
  documented: false
  detail: >-
    No signup, no console, no key request form was found on any Cosmose AI or KaiKai property. Access appears to be
    partner-provisioned; the iOS SDK distribution repository (repo.cosmose.co) also requires credentials — a
    directory listing of /repository/ios-sdk-releases/ returned 401 on 2026-08-11.