Ntu Authentication

# ntu — authentication posture across NTU's programmable surfaces.
generated: '2026-08-19'
method: probed
source: live probes 2026-08-19; https://libguides.ntu.edu.sg/drntudataguidespolicies/APITermsOfUse
provider: ntu
authentication:

  - surface: DR-NTU (Data) — Dataverse REST API
    x-operator: institution
    baseURL: https://researchdata.ntu.edu.sg/api
    public_read: true
    scheme: none
    detail: >-
      Dataverse serves published search and version endpoints unauthenticated. Deposit,
      administration and access to restricted files require a Dataverse API token supplied in the
      X-Dataverse-key header. Only the unauthenticated read subset is described in openapi/.
    token_header: X-Dataverse-key
    token_issuance: NTU account, via the DR-NTU (Data) web UI. Not self-service for non-NTU users.
    verified: false
    verification_note: >-
      Could not be re-verified on 2026-08-19 — the host returns a Citrix bot-management 403 to our
      probes on every path including the site root. Scheme is taken from the archived contract and
      the Dataverse 6.1 platform documentation, not from a fresh probe.

  - surface: DR-NTU (Digital Repository) — DSpace-CRIS REST API
    x-operator: tenant
    baseURL: https://dr.ntu.edu.sg/server/api
    public_read: true
    scheme: none
    detail: >-
      Discovery and item read operations answer unauthenticated; verified live 2026-08-19
      (HTTP 200, application/hal+json). Write and restricted-content operations use the DSpace 7
      JWT bearer flow at /server/api/authn/login. That flow is 4Science's DSpace-CRIS
      implementation, not NTU engineering.
    verified: true

  - surface: NTU institutional single sign-on (SGAF / eduGAIN)
    x-operator: tenant
    entityID: https://ntu-entra.singaren.net.sg/simplesaml/saml2/idp/metadata.php
    scheme: SAML 2.0 (IDPSSODescriptor + AttributeAuthorityDescriptor)
    scope: ntu.edu.sg
    detail: >-
      This is the only NTU-attributed authentication surface that is both machine-readable and
      independently registered. It authenticates humans into federated services; it is not an API
      authorization surface for third-party developers.
    verified: true

  - surface: api.ntu.edu.sg
    x-operator: institution
    scheme: unknown
    detail: >-
      A live NTU-owned API gateway host that returns a structured JSON envelope
      ({"statusCode":404,"message":"Resource not found"}) on every path probed. No authentication
      scheme is discoverable because no route is. Recorded so the host is not mistaken for absent.
    verified: false

notes:
  - >-
    NTU publishes no developer portal, no API key self-service, and no OAuth or OIDC authorization
    server for third-party API consumers. Nothing in this file should be read as a developer
    onboarding path.