Osha Authentication

generated: '2026-08-27'
method: searched
source: https://www.osha.gov/sites/default/files/ita/documentation/osha_injury-tracking-application-api-documentation-v1.pdf
docs:
  - https://www.osha.gov/sites/default/files/ita/documentation/osha_injury-tracking-application-api-documentation-v1.pdf
  - https://usdepartmentoflabor.github.io/Developer/beginner/
note: >-
  Derived from the provider's own published API documentation, not from an OpenAPI —
  neither OSHA nor DOL publishes a machine-readable contract for either surface.
  Two different auth models are in play across the two APIs this repo catalogs.
summary:
  types: [http, apiKey]
  http_schemes: [bearer]
  api_key_in: [header, query]
  oauth2_flows: []
  oidc: false
  mutual_tls: false
schemes:
  - name: ITABearerToken
    type: http
    scheme: bearer
    api: OSHA Injury Tracking Application (ITA) API
    base_url: https://www.osha.gov/oshaApi/v1
    header: 'Authorization: Bearer [ITA API Token]'
    applies_to: every ITA API call (establishments, forms/form300A, forms/caseData, submissions)
    token_issuance: >-
      Self-service, but account-gated: create an ITA account, log in at
      https://www.osha.gov/injuryreporting/ita and read the token from the API Token page.
      There is no public/anonymous read tier — the ITA API is a submission API for employers
      reporting their own 300A/300/301 injury and illness records.
    rotation: >-
      OSHA reissued every token in July 2018; the pre-2018 token format was invalidated
      outright. No rotation cadence or expiry is documented for the current format.
    source: https://www.osha.gov/sites/default/files/ita/documentation/osha_injury-tracking-application-api-documentation-v1.pdf
    observed:
      url: https://www.osha.gov/oshaApi/v1/establishments
      unauthenticated_status: 403
      fetched: '2026-08-27'
  - name: DOLDataApiKeyHeader
    type: apiKey
    in: header
    parameter_name: X-API-KEY
    api: OSHA Enforcement Data API (DOL data.dol.gov RESTful interface)
    base_url: https://data.dol.gov/get/
    source: https://usdepartmentoflabor.github.io/Developer/experienced/
    note: >-
      Key issuance is at https://devtools.dol.gov/developer, which the DOL developer portal
      itself flags as "New API Token Creation is Temporarily Disabled". A new integrator
      cannot obtain a credential for this surface today.
  - name: DOLDataApiKeyQuery
    type: apiKey
    in: query
    parameter_name: KEY
    api: DOL OData interface (api.dol.gov/V1)
    base_url: https://api.dol.gov/V1
    source: https://usdepartmentoflabor.github.io/Developer/experienced/
    note: >-
      Credential in the query string, so it lands in logs, proxies and browser history.
      Probed 2026-08-27: https://api.dol.gov/V1/DOLAgency/Agencies?KEY=test returns HTTP 403
      {"message":"Missing Authentication Token"} from AWS API Gateway.
gaps:
  - No OAuth 2.0, OpenID Connect or mTLS on any OSHA/DOL API surface.
  - No documented token expiry, refresh, scope or least-privilege model on the ITA bearer token.
  - No /.well-known/oauth-authorization-server or /.well-known/openid-configuration on any host (see well-known/osha-well-known.yml).