Sempra Energy Authentication

generated: '2026-08-28'
method: probed
source: >-
  Live unauthenticated HTTP probes of https://api.sempra.com on 2026-08-28. Sempra Energy
  publishes no authentication documentation on any public surface, so every statement here
  is read directly off the gateway's own responses. Host ownership is established from the
  DigiCert EV certificate on api.sempra.com, subject O=Sempra Energy, L=San Diego,
  ST=California, C=US.
api: Sempra Developer Portal APIs
base_url: https://api.sempra.com/v1
gateway: Google Apigee
note: >-
  api.sempra.com is an Apigee runtime. Requests to "/" return the Apigee
  messaging.adaptors.http.flow.ApplicationNotFound fault (HTTP 404), which means no proxy
  is routed there. A proxy IS routed at basepath /v1: every path under /v1 (including
  /v1/graphql, /v1/token and /v1/graphql/health) returns HTTP 401 with an Apigee OAuthV2
  fault, while /v2/graphql and /oauth/token return the 404 not-routed fault. That contrast
  is the evidence that /v1 is a real, live, OAuth-protected API basepath. No token issuance
  endpoint is discoverable anonymously and no scope, grant type or registration flow is
  published — credentials are obtained by registering on
  https://developer.sempra.com, whose anonymous API catalog is empty.
security_schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearer_format: OAuth 2.0 access token (Apigee OAuthV2)
  in: header
  header: Authorization
  method: probed
  evidence:
    request: GET https://api.sempra.com/v1/graphql
    status: 401
    www_authenticate: >-
      Bearer realm="null",error="invalid_token",error_description="oauth.v2.InvalidAccessToken:
      Invalid access token"
    body: '{"fault":{"faultstring":"Invalid access token","detail":{"errorcode":"oauth.v2.InvalidAccessToken"}}}'
  note: >-
    RFC 6750 bearer challenge. Presenting a syntactically valid but unknown bearer token
    changes the fault to keymanagement.service.invalid_access_token, confirming the token is
    validated against Apigee key management rather than merely parsed.
oauth2:
  detected: true
  detection: Apigee OAuthV2 VerifyAccessToken policy (oauth.v2.InvalidAccessToken fault)
  token_endpoint: null
  authorization_endpoint: null
  grant_types: []
  scopes: []
  note: >-
    No token, authorization or discovery endpoint is reachable anonymously.
    /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource both
    return the Apigee 404 not-routed fault on api.sempra.com. /oauth/token is not routed.
    Grant types and scopes are undocumented publicly.
transport:
  tls: true
  hsts: 'max-age=31536000 (on the /v1 proxy response)'
  cors:
    access_control_allow_origin: '*'
    access_control_allow_headers: '*'
    access_control_allow_methods: GET, PUT, POST, DELETE, OPTIONS, PATCH
    access_control_max_age: 3628800
    note: >-
      The gateway advertises a permissive wildcard CORS policy and six HTTP methods,
      which indicates a browser-callable read/write surface behind the token.
  content_security_policy: "script-src 'self'; child-src 'self'; form-action 'self'"
docs: null
docs_note: >-
  There is no public authentication page. https://developer.sempra.com requires
  registration and its anonymous catalog endpoint returns apiDocs [] and apiProducts [].