National Energy System Operator (NESO) · Authentication Profile

Neso Authentication

Authentication

Both NESO API surfaces are fully anonymous. There is no API key, no OAuth 2.0, no OpenID Connect, no mutual TLS, and no accreditation regime of any kind. A developer issues an ordinary HTTPS GET and receives JSON. This is a deliberate posture: NESO's data is Energy System Data published under an open licence in line with Ofgem's Data Best Practice Guidance, and there is no consumer data surface that would require a consent or authorisation flow.

National Energy System Operator (NESO) secures its APIs with none across 0 declared security schemes, as derived from its OpenAPI definitions.

EnergyUnited KingdomElectricityEnergy MarketsGridOpen DataCarbonRenewablesGasDemand Response
Methods: none Schemes: 0 OAuth flows: API key in:

Security Schemes

Source

Authentication Profile

neso-authentication.yml Raw ↑ 
generated: '2026-07-27'
method: searched
source: >-
  https://www.neso.energy/data-portal/api-guidance and live anonymous HTTP
  probes of both APIs on 2026-07-27. NESO publishes no OpenAPI, so there are no
  securitySchemes to derive from; this profile is the documented and
  probe-verified auth model.
docs: https://www.neso.energy/data-portal/api-guidance
description: >-
  Both NESO API surfaces are fully anonymous. There is no API key, no OAuth 2.0,
  no OpenID Connect, no mutual TLS, and no accreditation regime of any kind. A
  developer issues an ordinary HTTPS GET and receives JSON. This is a deliberate
  posture: NESO's data is Energy System Data published under an open licence in
  line with Ofgem's Data Best Practice Guidance, and there is no consumer data
  surface that would require a consent or authorisation flow.
summary:
  types: [none]
  api_key_in: []
  oauth2_flows: []
  anonymous: true
  registration_required: false
  accreditation_required: false
schemes: []
apis:
  - api: NESO Data Portal API
    base_url: https://api.neso.energy/api/3/action
    scheme: none
    detail: >-
      CKAN 2.8.7 Action API. package_list, package_search, package_show,
      organization_list, tag_list, resource_search, resource_show,
      datastore_search and datastore_search_sql all answer HTTP 200 anonymously
      with no key, cookie, account, referrer or token. A ckan session cookie is
      set on the response but is not required on the request.
    admin_login:
      url: https://api.neso.energy/user/login
      note: >-
        CKAN publisher/editor login for NESO data stewards. It is NOT a
        developer gate - the entire read API answers without it.
    verified: 2026-07-27
  - api: Carbon Intensity API
    base_url: https://api.carbonintensity.org.uk
    scheme: none
    detail: >-
      AWS API Gateway + CloudFront fronted REST/JSON. Every documented GET path
      answers 200 anonymously. No key header, no query-string token, no
      registration.
    verified: 2026-07-27
consumer_consent:
  applicable: false
  detail: >-
    NESO holds no retail customer relationships and exposes no individual
    consumption, billing, or account data, so there is no consent, authorisation
    or accredited-recipient flow to document. GB smart-meter consumption data
    moves through the licensed Smart DCC, not through the system operator.
attribution:
  required: true
  form: 'Supported by National Energy SO Open Data'
  licence: https://www.neso.energy/data-portal/neso-open-licence
related:
  conventions: conventions/neso-conventions.yml
  rate_limits: rate-limits/neso-rate-limits.yml
  well_known: well-known/neso-well-known.yml