Kallyope Authentication

generated: '2026-08-01'
method: probed
source: https://kallyope.com/wp-json/
docs: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
note: >-
  Kallyope publishes no authentication documentation of its own — there is no developer
  portal and no API reference. This profile is recorded from the live route index at
  https://kallyope.com/wp-json/ (whose `authentication` block advertises the mechanism)
  and from observed anonymous requests against every collection on 2026-08-01. The
  derive-authentication.py pass produced nothing because the derived OpenAPI declares
  no `securitySchemes` — that absence is the accurate finding, not a gap: the public
  read surface genuinely requires no credential.
summary:
  types: [none, http]
  anonymous_read: true
  api_key_in: []
  oauth2_flows: []
  oauth2: false
  openid_connect: false
  mutual_tls: false
api: kallyope:content-api
schemes:
- name: anonymous
  type: none
  description: >-
    Every GET collection and item route described in
    openapi/kallyope-content-api-openapi.yml returned HTTP 200 with real JSON and no
    credential of any kind. There is no API key, no signup, no token issuance and no
    per-consumer identity on this surface.
  applies_to: all read operations
  sources: [openapi/kallyope-content-api-openapi.yml]
  evidence:
    observed: '2026-08-01'
    example: GET https://kallyope.com/wp-json/wp/v2/document?per_page=1 -> 200
- name: application-passwords
  type: http
  scheme: basic
  description: >-
    WordPress Application Passwords, advertised verbatim by the route index
    `authentication` block. Credentials are minted per WordPress user in the site admin
    and presented as HTTP Basic. This is the write/administrative path — it is not
    offered to third parties and no self-service registration exists.
  authorization_endpoint: https://kallyope.com/wp-admin/authorize-application.php
  audience: internal WordPress users only
  sources: [https://kallyope.com/wp-json/]
- name: cookie-nonce
  type: apiKey
  in: header
  parameter_name: X-WP-Nonce
  description: >-
    The stock WordPress logged-in cookie plus an `X-WP-Nonce` header, used by the block
    editor and admin JavaScript. Advertised indirectly by the
    `Access-Control-Allow-Headers: Authorization, X-WP-Nonce, ...` response header
    observed on every route. Browser-session only; not a third-party integration path.
  sources: [https://kallyope.com/wp-json/wp/v2/document]
observations:
- Anonymous writes are not possible - POST/PUT/PATCH/DELETE are registered on these
  collections but every mutating endpoint is capability-gated behind the two schemes above.
- 'GET /wp/v2/settings returned 401 {"code":"rest_forbidden","data":{"status":401}} anonymously,
  confirming the capability gate is enforced rather than merely documented.'
- No OAuth 2.0, OpenID Connect or mTLS surface exists; /.well-known/openid-configuration
  and /.well-known/oauth-authorization-server both returned 404 on kallyope.com.
- No rate limiting, quota or per-consumer throttling headers were observed on any response.
scopes: none
scopes_note: >-
  No OAuth scope surface exists. WordPress authorizes by user capability
  (read/edit_posts/manage_options), not by scope, so scopes/ is deliberately absent
  rather than empty.