Pjm Authentication

generated: '2026-07-27'
method: searched
source: >-
  PJM Data Miner API Guide (v15, 02/10/2026), PJM Browserless Authentication Guide,
  PJM PKI-Based Authentication Guide, PJM OASIS API User Guide (Rev 04, 2023-01-27),
  plus anonymous probes of api.pjm.com, sso.pjm.com, apiportal.pjm.com and
  messages.pjm.com on 2026-07-27.
docs: https://www.pjm.com/markets-and-operations/etools/security.aspx
summary:
  types: [apiKey, custom-session-token, mutualTLS, none]
  api_key_in: [header, query]
  oauth2_flows: []
  openid_connect: false
  note: >-
    PJM publishes no OAuth 2.0 or OpenID Connect surface. GET
    https://sso.pjm.com/.well-known/openid-configuration returned HTTP 404 and
    https://www.pjm.com/.well-known/openid-configuration returned the pjm.com HTML
    shell (soft 404). Authentication is split three ways: an Azure API Management
    subscription key for Data Miner 2, a ForgeRock OpenAM session token (with an
    optional/required PKI client certificate) for the eTools surfaces, and fully
    anonymous access for the public Messages web service.
schemes:
- name: DataMinerSubscriptionKey
  type: apiKey
  in: header
  parameter: Ocp-Apim-Subscription-Key
  applies_to:
  - PJM Data Miner 2 API (https://api.pjm.com/api/v1)
  - PJM Data Miner 2 training API (https://api-train.pjm.com/api/v1)
  platform: Azure API Management
  cost: free
  provisioning: >-
    Requires a PJM Tools username provisioned for Data Miner. Member companies
    request access via PJM Account Manager > Account Access > Request Access > Data
    Miner API. Non-member companies email accountmanager@pjm.com with the statement
    "I confirm that the PJM Data will be used for internal business purposes only",
    their Account Manager user id and their subscribing email address. A Customer
    Account Manager approves; the key is then read from View Profile > Your
    Subscriptions.
  constraint: >-
    One subscription key is bound to one unique email address; unlike other PJM
    tools, no other user accounts may be tied to that email address (Data Miner FAQ).
    System accounts are allowed provided a valid email address is attached to the
    user id and the company CAM provisions it for traceability.
  source: https://www.pjm.com/-/media/DotCom/etools/data-miner-2/data-miner-2-api-guide.ashx
  verified: 'GET https://api.pjm.com/api/v1/gen_by_fuel returned HTTP 401 anonymously on 2026-07-27'
- name: DataMinerSubscriptionKeyQuery
  type: apiKey
  in: query
  parameter: subscription-key
  applies_to:
  - PJM Data Miner 2 API (https://api.pjm.com/api/v1)
  note: >-
    Same credential as the header form; the guide documents appending
    &subscription-key=<yourkey> to a request URL for browser/Excel/data-connection
    use.
  source: https://www.pjm.com/-/media/DotCom/etools/data-miner-2/data-miner-2-api-guide.ashx
- name: PJMSingleSignOnToken
  type: custom-session-token
  in: cookie
  parameter: pjmauth
  training_parameter: pjmauthtrain
  applies_to:
  - PJM OASIS Template API
  - PJM InSchedule Browserless API
  - PJM eDART Browserless API
  - other PJM eTools browserless interfaces
  platform: ForgeRock OpenAM
  flow: >-
    POST https://sso.pjm.com/access/authenticate/ with the headers X-OpenAM-Username
    and X-OpenAM-Password. The JSON response carries a tokenId, which is presented as
    the pjmauth cookie on subsequent tool API calls and released with POST
    https://sso.pjm.com/access/logout/.
  token_endpoint: https://sso.pjm.com/access/authenticate/
  revocation_endpoint: https://sso.pjm.com/access/logout/
  source: https://www.pjm.com/-/media/DotCom/etools/pjm-browserless-authentication-guide.pdf
  verified: 'GET https://sso.pjm.com/access/authenticate/ returned HTTP 405 Method Not Allowed on 2026-07-27, confirming the documented POST-only endpoint'
- name: PJMClientCertificate
  type: mutualTLS
  applies_to:
  - Custom-code REST clients against PJM eTools
  flow: >-
    Two-way TLS with a PJM-issued client certificate against the
    access/authenticate/pjmauthcert endpoint, presented alongside credentials to
    obtain the SSO token.
  source: https://www.pjm.com/-/media/DotCom/etools/security/pki-authentication-guide.pdf
- name: PublicAnonymous
  type: none
  applies_to:
  - PJM Messages Public Web Service (https://messages.pjm.com/messages/rest/public)
  - PJM OASIS public information page (https://pjmoasis.pjm.com/OASIS/PJM/INFO.HTM)
  note: >-
    The Messages public web service and the NAESB WEQ-002-4.5.2 mandated OASIS
    Online Resources posting are served with no credential of any kind.
  verified: 'GET https://messages.pjm.com/messages/rest/public/messages returned HTTP 200 anonymously on 2026-07-27'
transport:
  tls_minimum: TLS 1.2
  note: >-
    "In general, Tls1.2 is required for all PJM tools, including Data Miner." PJM
    retired TLS 1.0/1.1 from internet-facing applications in the April 2022 Data
    Miner release, and its security appliance began enforcing strict HTTP protocol
    rules on 2025-11-01 (an HTTP GET carrying a body is rejected).
  source: https://www.pjm.com/-/media/DotCom/etools/data-miner-2/data-miner-2-api-guide.ashx