Defense Contract Audit Agency · Authentication Profile

Defense Contract Audit Agency Authentication

Authentication

Defense Contract Audit Agency secures its APIs with none and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

Federal-GovernmentDefenseDepartment of DefenseAuditContract AuditFinancialGovernment ContractingCAGE CodeUnique Entity IdentifierLocator

Methods: none, openIdConnect Schemes: 2 OAuth flows: authorizationCode API key in:

Security Schemes

anonymous none

piee-oidc openIdConnect

· flows: authorizationCode

Source

Authentication Profile

generated: '2026-09-07'
method: probed
source: >-
  live HTTP probes 2026-09-07 of https://fao.dcaa.mil/api and https://csp.dcaa.mil/ —
  DCAA publishes no OpenAPI, so there are no securitySchemes to derive from; every field
  below was observed on the wire.
note: >-
  Two distinct DCAA surfaces with two distinct auth models. The public Branch Locator API
  is anonymous. The Contractor Submission Portal is federated to DoD PIEE over OpenID
  Connect. There is no developer-facing authentication documentation of any kind — no API
  keys, no client registration, no token endpoint DCAA operates itself.
summary:
  types: [none, openIdConnect]
  api_key_in: []
  oauth2_flows: [authorizationCode]
schemes:
  - name: anonymous
    type: none
    applies_to: https://fao.dcaa.mil/api
    description: >-
      The DCAA Field Audit Office Branch Locator API answers unauthenticated GET requests.
      No Authorization header, API key, cookie or referer check was required for any of the
      six observed operations; responses carry only Strict-Transport-Security.
    evidence:
      - url: https://fao.dcaa.mil/api/angularconfiguration/get-uei-regex
        status: 200
        observed: '2026-09-07'
      - url: https://fao.dcaa.mil/api/PublicBranch/search?searchCriteria=22060&searchType=2
        status: 200
        observed: '2026-09-07'
  - name: piee-oidc
    type: openIdConnect
    applies_to: https://csp.dcaa.mil/
    description: >-
      The DCAA Contractor Submission Portal (CSP) delegates sign-in to the DoD Procurement
      Integrated Enterprise Environment (PIEE). An unauthenticated request to any CSP path
      returns 302 to the PIEE authorization endpoint with the OAuth 2.0 authorization-code
      flow and PKCE (S256). DCAA operates the relying party; PIEE operates the
      authorization server. Credentials are DoD PIEE accounts (CAC/ECA), not developer keys.
    flows:
      - flow: authorizationCode
        authorizationUrl: https://piee.eb.mil/portal/oauth2/authorize
        tokenUrl: null
        pkce: S256
        client_id: csp
        redirect_uri: https://csp.dcaa.mil/signin-oidc
        scopes: [openid, profile]
    authorization_server:
      host: piee.eb.mil
      operator: DoD Procurement Integrated Enterprise Environment (PIEE)
      first_party: false
      discovery_document: >-
        none served — /.well-known/openid-configuration and
        /.well-known/oauth-authorization-server both returned 404 on piee.eb.mil (2026-09-07)
    evidence:
      - url: https://csp.dcaa.mil/
        status: 302
        redirect_to: https://piee.eb.mil/portal/oauth2/authorize?client_id=csp&redirect_uri=https%3A%2F%2Fcsp.dcaa.mil%2Fsignin-oidc&response_type=code&scope=openid%20profile&code_challenge_method=S256
        observed: '2026-09-07'
docs: null

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/defense-contract-audit-agency-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.