Metalenz publishes no developer program and issues no API credentials. The WordPress REST content API behind metalenz.com is anonymously readable — no key, token, signature or account is required to read press releases, pages, media, taxonomies, search, oEmbed or the discovery metadata. The server declares exactly one authentication method in its own root document, WordPress application passwords, and that method gates only the write and privileged-read operations that are not part of the public surface. Separately, Metalenz runs a credential-gated documentation portal at docs.metalenz.com behind Microsoft Entra ID; that is a human login, not an API credential.
Metalenz declares 0 security scheme(s) across its OpenAPI definitions.
generated: '2026-08-25'
method: probed
source: https://metalenz.com/wp-json/
docs: https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/
description: >-
Metalenz publishes no developer program and issues no API credentials. The WordPress REST content
API behind metalenz.com is anonymously readable — no key, token, signature or account is required
to read press releases, pages, media, taxonomies, search, oEmbed or the discovery metadata. The
server declares exactly one authentication method in its own root document, WordPress application
passwords, and that method gates only the write and privileged-read operations that are not part
of the public surface. Separately, Metalenz runs a credential-gated documentation portal at
docs.metalenz.com behind Microsoft Entra ID; that is a human login, not an API credential.
summary:
types: []
anonymous_read: true
credentialed_write: true
api_key_in: []
oauth2_flows: []
note: >-
No securityScheme appears in any of the seven derived OpenAPI documents because the public
surface genuinely has none. This is a recorded absence, not a gap in harvesting.
schemes: []
declared_by_server:
- name: application-passwords
type: http
scheme: basic
description: >-
WordPress application passwords (RFC 7617 Basic over TLS, username + generated application
password). Declared in the `authentication` block of the API root document. Required for every
write method and for privileged reads such as GET /wp/v2/settings, /wp/v2/themes,
/wp/v2/plugins, /wp/v2/menus and the whole widget/template/global-styles surface. Credentials
are issued per WordPress user from the site admin — there is no public registration path, so
this is a staff-only credential, not a developer credential.
authorization_endpoint: https://metalenz.com/wp-admin/authorize-application.php
source: https://metalenz.com/wp-json/
adjacent_identity_systems:
- name: Microsoft Entra ID (Azure AD)
applies_to: https://docs.metalenz.com/documentation/
protocol: OpenID Connect 1.0 (implicit id_token, prompt=select_account)
tenant: 8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361
issuer: https://login.microsoftonline.com/8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361/v2.0
authorization_endpoint: https://login.microsoftonline.com/8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361/oauth2/v2.0/authorize
scopes_supported: [openid, profile, email, offline_access]
detail: >-
docs.metalenz.com serves a two-line landing page linking to /documentation/, which 301s to
/documentation/ and then redirects into the Microsoft Entra ID authorize endpoint for the
Metalenz tenant. This is Metalenz's customer/partner documentation for its optics products and
it is not reachable without an account. It is recorded here because it is the only identity
surface Metalenz operates, but it protects human documentation, not an API: no API is
advertised behind it and no protected-resource metadata is published. The tenant and client
identifiers above are public values emitted in the redirect URL, not secrets.
evidence:
- url: https://metalenz.com/wp-json/
http_status: 200
finding: 'authentication: {"application-passwords": {"endpoints": {"authorization": "https://metalenz.com/wp-admin/authorize-application.php"}}}'
- url: https://metalenz.com/wp-json/wp/v2/posts?per_page=2
http_status: 200
finding: 'Anonymous read succeeds; response carries `Allow: GET`, confirming read-only anonymous access. X-WP-Total 26.'
- url: https://metalenz.com/wp-json/wp/v2/media?per_page=2
http_status: 200
finding: Anonymous read of the media library succeeds, X-WP-Total 418.
- url: https://metalenz.com/wp-json/wp/v2/settings
http_status: 401
finding: '{"code":"rest_forbidden","message":"Sorry, you are not allowed to do that.","data":{"status":401}}'
- url: https://metalenz.com/wp-json/wp/v2/themes
http_status: 401
finding: 'Privileged read is credential-gated: {"code":"rest_cannot_view_themes",...}'
- url: https://docs.metalenz.com/documentation
http_status: 301
finding: 301 to /documentation/, which redirects into login.microsoftonline.com — Entra ID gate.
- url: https://login.microsoftonline.com/8dd6aaa4-ef1b-4a81-a14f-ef61ccec4361/v2.0/.well-known/openid-configuration
http_status: 200
finding: OpenID Provider metadata for the Metalenz tenant; confirms the gate is OIDC.
x-evidence:
fetched: '2026-08-25'
probes: 7