Essential Energy Authentication

generated: '2026-07-27'
method: probed
source: >-
  https://services-ap1.arcgis.com/3o0vFs4fJRsuYuBO/arcgis/rest/info?f=json and
  https://essentialenergy.maps.arcgis.com/sharing/rest/info?f=json (both HTTP 200,
  anonymous, 2026-07-27), plus repeated anonymous query calls against the published
  FeatureServers.
docs: null
summary:
  types:
  - none
  api_key_in: []
  oauth2_flows: []
  headline: >-
    The public Essential Energy API surface requires NO authentication. Every published
    FeatureServer answers anonymous HTTPS GET. Esri token-based security exists on the
    hosting platform for non-public content, but no Essential Energy credential, key,
    signup or accreditation is issued to developers.
schemes:
- name: anonymous
  type: none
  description: >-
    All 100 public ArcGIS REST FeatureServers under org 3o0vFs4fJRsuYuBO answer
    unauthenticated requests. No Authorization header, no api key parameter, no cookie
    and no referrer restriction was required for any verified call.
  verified:
  - request: >-
      GET https://services-ap1.arcgis.com/3o0vFs4fJRsuYuBO/arcgis/rest/services?f=json
    status: 200
  - request: >-
      GET https://services-ap1.arcgis.com/3o0vFs4fJRsuYuBO/arcgis/rest/services/HostingCapacity_Substation_GEN/FeatureServer/1/query?where=1%3D1&outFields=*&resultRecordCount=2&f=json
    status: 200
  - request: >-
      GET https://services-ap1.arcgis.com/3o0vFs4fJRsuYuBO/arcgis/rest/services/Substation/FeatureServer/0/query?where=1%3D1&returnCountOnly=true&f=json
    status: 200
    note: returned {"count":144569}
  sources:
  - arcgis/essential-energy-arcgis-services-catalog.json
  - examples/essential-energy-examples.yml
- name: arcgis-token
  type: token
  description: >-
    The hosting platform (Esri ArcGIS Online) advertises token-based security for
    content that is NOT shared publicly. This is an Esri platform mechanism bound to an
    ArcGIS Online named user, not an Essential Energy developer credential — Essential
    Energy issues no accounts against it and none of the public layers require it.
  platform: Esri ArcGIS Online
  token_service: https://www.arcgis.com/sharing/generateToken
  portal_token_service: https://www.arcgis.com/sharing/rest/generateToken
  is_token_based_security: true
  owning_system_url: https://www.arcgis.com
  owning_tenant: 3o0vFs4fJRsuYuBO
  sources:
  - arcgis/essential-energy-arcgis-rest-info.json
not_present:
  api_key: >-
    No API key is issued or required. developer., developers., api. and docs.
    essentialenergy.com.au do not resolve (NXDOMAIN, verified 2026-07-27), so there is
    no key-issuing developer portal.
  oauth2: >-
    No OAuth 2.0 authorization or token endpoint is published by Essential Energy.
    /.well-known/oauth-authorization-server returns 403 (Cloudflare) on www. and 404 on
    dapr. and engage. hosts.
  openid_connect: >-
    /.well-known/openid-configuration returns no document on any Essential Energy host.
  mutual_tls: >-
    No mTLS profile is published. No client-certificate challenge was observed on any
    verified call.
  cdr_accreditation: >-
    The Australian Consumer Data Right accreditation model does NOT apply. Essential
    Energy is a distribution network service provider and is absent from the public CDR
    energy data-holder brand register (see review.yml mandate.statusEvidence).
gated_surfaces:
- name: Network Information Portal
  description: >-
    The ordering of formal network data packages (pole data, network routes) for
    Accredited Service Providers, electrical contractors, councils and emergency
    services runs through a request/order workflow behind Esri/ArcGIS Online identity.
    That is a customer/partner login, not a published developer auth scheme, and it
    exposes no documented API.
  url: https://engage.essentialenergy.com.au/access-to-network-data
observations:
- >-
    Service metadata for Suitable_Poles_2026 advertises capabilities "Query,Update,Editing"
    while every other sampled service advertises "Query" or "Query,Extract". This is
    recorded verbatim from the published service descriptor; no write operation was
    attempted. Read-only consumers should treat the surface as query-only.