Ripe Insurance Authentication

generated: '2026-07-25'
method: searched
source: >-
  https://www.ripeinsurance.co.uk/.well-known/openid-configuration (fetched 2026-07-25),
  openapi/ripe-insurance-umbraco-content-delivery-openapi.json,
  openapi/ripe-insurance-cycleplan-content-delivery-openapi.json,
  https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api
docs: https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api#protected-content
summary:
  types: [none, apiKey, oauth2, openIdConnect]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken]
  developer_credentials_available: false
  note: >-
    Ripe Insurance issues NO developer or partner credentials. There is no sign-up for
    API access, no key-management console and no client-registration endpoint. What
    exists is (a) an anonymous, unauthenticated read surface on the Umbraco Content
    Delivery API and (b) an OpenID Connect server for website customer login. The
    apiKey scheme below is an optional Umbraco platform feature declared as a header
    parameter in the specification — it is NOT declared as an OpenAPI securityScheme
    and no key is obtainable by an outside developer.
schemes:
- name: anonymous
  type: none
  description: >-
    The Content Delivery API is served anonymously. All eight v2 operations on
    ripeinsurance.co.uk (and sixteen v1+v2 operations on cycleplan.co.uk) return 200
    with no credential. Verified live 2026-07-25 against
    /umbraco/delivery/api/v2/content (345 content items returned).
  sources:
  - openapi/ripe-insurance-umbraco-content-delivery-openapi.json
  - openapi/ripe-insurance-cycleplan-content-delivery-openapi.json
- name: Api-Key
  type: apiKey
  in: header
  parameter_name: Api-Key
  declared_as_security_scheme: false
  description: >-
    Umbraco platform feature. Declared in the specification as an optional request
    header on every operation ("API key specified through configuration to authorize
    access to the API") rather than in components.securitySchemes. It gates
    configuration-level access to the Delivery API. Ripe publishes no way to obtain
    one.
  sources:
  - openapi/ripe-insurance-umbraco-content-delivery-openapi.json
  - openapi/ripe-insurance-cycleplan-content-delivery-openapi.json
- name: umbraco-member-oidc
  type: openIdConnect
  openIdConnectUrl: https://www.ripeinsurance.co.uk/.well-known/openid-configuration
  description: >-
    The Umbraco/OpenIddict member-authentication server behind the Ripe Insurance
    customer login (www.ripeinsurance.co.uk/login redirects to
    account.ripeinsurance.co.uk). It protects member-only website content, including
    member-protected items served by the Content Delivery API — the reason
    GetContentItemById2.0 and GetContentItemByPath2.0 declare 401 and 403 responses.
    It is a consumer login system, not a partner API authorization server.
  issuer: https://www.ripeinsurance.co.uk/
  endpoints:
    authorization: https://www.ripeinsurance.co.uk/umbraco/delivery/api/v1/security/member/authorize
    token: https://www.ripeinsurance.co.uk/umbraco/delivery/api/v1/security/member/token
    userinfo: https://www.ripeinsurance.co.uk/umbraco/delivery/api/v1/security/member/userinfo
    end_session: https://www.ripeinsurance.co.uk/umbraco/delivery/api/v1/security/member/signout
    revocation: https://www.ripeinsurance.co.uk/umbraco/delivery/api/v1/security/member/revoke
    jwks: https://www.ripeinsurance.co.uk/.well-known/jwks
  grant_types: [authorization_code, refresh_token, client_credentials]
  response_types: [code]
  scopes_supported: [openid, offline_access]
  pkce:
    supported: true
    code_challenge_methods: [plain, S256]
  token_endpoint_auth_methods: [client_secret_post, private_key_jwt, client_secret_basic]
  id_token_signing_alg_values: [RS256]
  par_required: false
  mtls_bound_tokens: false
  client_registration:
    dynamic: false
    note: No RFC 7591 registration_endpoint is advertised. Clients are configured server-side.
  sources:
  - well-known/ripe-insurance-openid-configuration.json
  peer_issuers:
  - https://www.cycleplan.co.uk/
  - https://www.golfcare.co.uk/
  - https://www.insure4sport.co.uk/
insurance_api_auth:
  present: false
  note: >-
    No quote, bind, issue, policy, billing or FNOL API is published, so no
    authentication model exists for one. Partnering runs through a business-development
    enquiry form at https://www.ripethinking.co.uk/partner-with-us/.