Heuritech Authentication

generated: '2026-08-17'
method: probed
source: >-
  https://heuritech.com/wp-json/ (authentication block + live probes) and
  https://heuritech.com/.well-known/oauth-authorization-server
docs: null
description: >-
  Heuritech has three distinct authentication postures, one per surface, and only two of them are
  publicly observable. The mechanical derive-authentication pass found no securitySchemes because the
  OpenAPI documents in this repo are API Evangelist derivations of an anonymously-readable WordPress
  REST surface, which declares none; the profile below was established by live probe instead.
summary:
  types: [none, http, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  note: >-
    No API-key scheme is publicly documented anywhere on the Heuritech estate. The commercial product
    API almost certainly has one, but Heuritech does not publish it, and guessing it would be fabrication.
schemes:
- name: AnonymousRead
  type: none
  surface: WordPress REST content API (wp/v2)
  source: https://heuritech.com/wp-json/wp/v2/posts
  description: >-
    Read operations on posts, pages, media, comments, categories, tags, users, search and the
    type/taxonomy/status discovery routes require no credentials. Verified live: HTTP 200 with
    X-WP-Total on every collection.
  verified_status: 200
- name: WordPressApplicationPassword
  type: http
  scheme: basic
  surface: WordPress REST content API (wp/v2) — write operations
  source: https://heuritech.com/wp-json/ (authentication block)
  authorization_endpoint: https://heuritech.com/wp-admin/authorize-application.php
  description: >-
    WordPress Application Passwords over HTTP Basic, the only authentication method the route index
    advertises. Also accepted: logged-in cookie plus an X-WP-Nonce header (the site's
    Access-Control-Allow-Headers lists Authorization, X-WP-Nonce, Content-Disposition, Content-MD5
    and Content-Type). Write operations are not modelled in this repo's OpenAPI documents.
- name: HeuritechMCPOAuth
  type: oauth2
  surface: Heuritech MCP server
  source: https://heuritech.com/.well-known/oauth-authorization-server
  issuer: https://heuritech.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://heuritech.com/oauth/authorize
    tokenUrl: https://heuritech.com/oauth/token
    revocationUrl: https://heuritech.com/oauth/revoke
    pkce: required
    code_challenge_methods: [S256]
    scopes: 1
  description: >-
    OAuth 2.1 authorization code with PKCE guarding https://heuritech.com/wp-json/mcp/mcp-oauth-server.
    Public clients (token_endpoint_auth_methods_supported: none) with client-ID metadata documents
    instead of dynamic registration. Bearer token in the Authorization header. The 401 challenge is
    RFC 9728 compliant and names the protected-resource document.
  detail: scopes/heuritech-scopes.yml
undocumented:
- surface: Heuritech Trend Data API
  reason: >-
    Heuritech publishes no authentication documentation for its commercial API. The product page, the
    pricing page and the FAQ all route prospective customers to a sales demo, and no developer portal,
    API reference or key-management page exists on any Heuritech host. Recorded as undocumented rather
    than assumed to be an API key.
  probes:
  - url: https://docs.heuritech.com/
    status: 404
  - url: https://developer.heuritech.com/
    status: 404
  - url: https://api.heuritech.com/docs
    status: 404
x-evidence:
  fetched: '2026-08-17'
  probes:
  - url: https://heuritech.com/wp-json/wp/v2/posts?per_page=1
    status: 200
  - url: https://heuritech.com/wp-json/
    status: 200
  - url: https://heuritech.com/.well-known/oauth-authorization-server/
    status: 200
  - url: https://heuritech.com/wp-json/mcp/mcp-oauth-server
    status: 401