Das Technology Authentication

generated: '2026-08-12'
method: probed
source: >-
  https://api.digitalairstrike.com/v1/account/{accountGuid} (live unauthenticated GET, HTTP 401)
  plus openapi/_original/das-technology-daswebapi-v1-swagger.json and
  openapi/_original/das-technology-daswebapi-v2-swagger.json
api: DAS Web API (DASWebAPI v1 + v2)
note: >-
  Neither published Swagger 2.0 document declares a securityDefinitions block, so the
  authentication profile could not be derived from the spec — it was PROBED from the live API.
  An unauthenticated request to any v1 or v2 resource returns HTTP 401 with the header
  `WWW-Authenticate: Bearer` and an XML error body, which establishes bearer-token
  authentication as the deployed scheme. DAS Technology publishes no developer portal, no
  authentication guide and no token endpoint that answers anonymously (both /token and
  /oauth/token return 404), so how a bearer token is ISSUED is not publicly documented;
  credentials appear to be provisioned through the partner/dealer relationship. This is a
  documentation gap on the provider's side, recorded here rather than guessed at.
schemes:
- name: bearer
  type: http
  scheme: bearer
  in: header
  parameter: Authorization
  method: probed
  evidence:
    url: https://api.digitalairstrike.com/v1/account/00000000-0000-0000-0000-000000000000
    http_status: 401
    response_header: 'WWW-Authenticate: Bearer'
    body: '<Error><Message>Authorization has been denied for this request.</Message></Error>'
  declared_in_spec: false
  token_endpoint: null
  token_endpoint_note: >-
    POST https://api.digitalairstrike.com/token returns 404 and POST /oauth/token returns 404;
    no anonymous token or OIDC/OAuth discovery document was found on any host (see
    well-known/das-technology-well-known.yml).
oauth2: false
openid_connect: false
mutual_tls: false
api_key: false
anonymous_operations: 0
gaps:
- id: security-not-declared
  detail: >-
    All 136 operations across v1 and v2 are served behind bearer auth but neither Swagger
    document carries a securityDefinitions block or an operation-level security requirement, so a
    generated client will emit unauthenticated calls that 401.
  remediation: >-
    Add a securityDefinitions entry (type apiKey, name Authorization, in header — or migrate to
    OpenAPI 3.x and declare an http/bearer scheme) and a top-level security requirement.
- id: no-published-token-flow
  detail: How a caller obtains a bearer token is not documented on any public DAS Technology surface.
  remediation: Publish an authentication page describing the token grant, lifetime and refresh behavior.