Sapienza University Of Rome Authentication

generated: '2026-09-01'
method: probed
source: >-
  Live probes of Sapienza University of Rome institution-operated hosts on 2026-09-01. No OpenAPI
  or published security scheme exists for any Sapienza surface; every entry below is the observed
  behaviour of a real request, recorded so an unauthenticated 401/403 is not mistaken for an
  absent API or for a callable one.
note: >-
  Sapienza publishes no developer portal, no self-service key issuance and no authentication
  documentation. Two REST APIs exist on institution hosts and both refuse anonymous callers; two
  OAI-PMH providers on the same hosts are fully open and keyless. This split — an open harvesting
  protocol beside a closed product REST API — is the whole of the institution's public access
  story.
summary:
  types:
  - none
  - http-basic
  - saml
  keyless_surfaces: 2
  gated_surfaces: 2
  self_service_key_issuance: false
  documented: false
schemes:
- name: oai-pmh-anonymous
  type: none
  status: open
  operator: institution
  description: >-
    Both OAI-PMH 2.0 providers are keyless and anonymous. No Authorization header, API key,
    referer or cookie is required for any verb.
  evidence:
  - url: https://iris.uniroma1.it/oai/request?verb=Identify
    status: 200
  - url: https://iris.uniroma1.it/oai/request?verb=ListRecords&metadataPrefix=oai_dc
    status: 200
  - url: https://rosa.uniroma1.it/rosa04/index/oai?verb=Identify
    status: 200
  - url: https://rosa.uniroma1.it/rosa04/index/oai?verb=ListSets
    status: 200
- name: iris-dspace-rest-basic
  type: http
  scheme: basic
  status: gated
  operator: institution
  description: >-
    The DSpace REST API on the IRIS host rejects anonymous callers with HTTP basic authentication.
    The response body is the literal string "HTTP Status 401 - Invalid basic authentication token"
    (53 bytes, no WWW-Authenticate challenge document, no JSON error envelope). No public route to
    obtain credentials is documented anywhere on uniroma1.it; the platform is DSpace-CRIS supplied
    by CINECA, so both the scheme and the contract are the vendor's.
  evidence:
  - url: https://iris.uniroma1.it/rest/
    status: 401
  - url: https://iris.uniroma1.it/rest/items
    status: 401
- name: ojs-rest-api-token
  type: apiKey
  status: gated
  operator: institution
  description: >-
    The Open Journal Systems REST API v1 on the R.O.SA host answers anonymous callers with 403
    application/json {"error":"api.403.unauthorized","errorMessage":"You are not authorized to
    access the requested resource."}. OJS gates /api/v1/ behind a per-user API token issued from
    the journal editorial back office; there is no public registration flow. The API contract is
    PKP's, not Sapienza's, and is not saved under this institution.
  evidence:
  - url: https://rosa.uniroma1.it/rosa04/annali_di_botanica/api/v1/issues
    status: 403
- name: shibboleth-saml-sso
  type: saml
  status: federated
  operator: institution
  description: >-
    Human access to Sapienza's gated systems is federated through the institution's own Shibboleth
    SAML 2.0 identity provider, entityID https://idp.uniroma1.it/idp/shibboleth, scope
    "uniroma1.it", registered in the IDEM GARR AAI national federation. The IdP metadata is
    machine-readable and public; the authentication itself is interactive and not an API surface.
  evidence:
  - url: https://idp.uniroma1.it/idp/shibboleth
    status: 200
  - url: https://md.idem.garr.it/metadata/idem-metadata-sha256.xml
    status: 200