Cutiss Authentication

generated: '2026-08-11'
method: probed
source: https://cutiss.swiss/wp-json/ route index + live anonymous and unauthenticated probes
summary: 'The CUTISS content API is anonymous-read. No credential is required or accepted for the public
  collections; every write method and every administrative collection is refused with HTTP 401 rest_forbidden.
  The route index advertises no authentication method ("authentication": []), meaning no application-password
  or OAuth provider is registered.'
schemes:
- name: none
  type: none
  scope: public read
  description: Anonymous GET on posts, pages, media, categories, newsroom2021, team_member, cutiss-teams,
    search, types, taxonomies and statuses. Verified 200 without credentials.
  applies_to:
  - listPosts
  - listPages
  - listMedia
  - listCategories
  - listNewsroom
  - listTeam
  - listTeams
  - listSearch
- name: wordpress-cookie-nonce
  type: apiKey
  in: header
  header: X-WP-Nonce
  scope: write / privileged read
  advertised: true
  obtainable_by_public: false
  description: 'WordPress core''s first-party authentication: a logged-in session cookie plus an X-WP-Nonce
    header. The header is advertised in Access-Control-Allow-Headers on every response. Only issued to
    authenticated CUTISS staff in wp-admin; there is no public registration, so this is not a usable scheme
    for a third-party integrator.'
gated_surfaces:
- path: /wp/v2/users
  status: 401
  code: rest_forbidden
- path: /wp/v2/settings
  status: 401
  code: rest_forbidden
- path: /wp/v2/plugins
  status: 401
  code: rest_forbidden
- path: /wp/v2/menus
  status: 401
  code: rest_forbidden
- path: /wp/v2/block-types
  status: 401
  code: rest_forbidden
- path: /wp-abilities/v1/abilities
  status: 401
  code: rest_forbidden
- path: /wp-abilities/v1/categories
  status: 401
  code: rest_forbidden
oauth:
  supported: false
  note: No /.well-known/oauth-authorization-server and no /.well-known/openid-configuration (both 404).
    No OAuth scope surface exists, so no scopes/ artifact is written.
registration:
  public_signup: false
  note: CUTISS offers no developer account, API key issuance or sign-up flow of any kind.