Sempra Authentication

generated: '2026-09-04'
method: probed
source: >-
  Live unauthenticated HTTP probes of https://api.sempra.com on 2026-09-04. Sempra
  publishes no authentication documentation on any public surface, so every statement
  below is read directly off the gateway's own responses. Host ownership is established
  from the DigiCert EV certificate on api.sempra.com — subject O=Sempra Energy,
  L=San Diego, ST=California, C=US, serialNumber 2062548, issuer DigiCert EV RSA CA G2.
api: Sempra Developer Portal APIs
base_url: https://api.sempra.com/v1
gateway: Google Apigee
docs: null
docs_note: >-
  There is no public authentication page. https://developer.sempra.com requires
  registration; its anonymous catalog endpoint
  /portals/api/sites/sempra-prod/liveportal/apis returns HTTP 200 with apiDocs [] and
  apiProducts [], and its header menu is exactly "APIs" and "Log In".
note: >-
  api.sempra.com is an Apigee runtime. A request to "/" returns the Apigee
  messaging.adaptors.http.flow.ApplicationNotFound fault (HTTP 404), meaning no proxy is
  routed there. A proxy IS routed at basepath /v1: every path under /v1 — including
  /v1, /v1/graphql, /v1/token and /v1/openapi.json — returns HTTP 401 with an Apigee
  OAuthV2 fault, while /v2/graphql, /oauth/token, /openapi.json, /swagger.json,
  /api-docs and /docs return the not-routed 404. That contrast is the evidence that /v1
  is a real, live, OAuth-protected API basepath. No token issuance endpoint is
  discoverable anonymously and no scope, grant type or client registration flow is
  published — credentials are obtained by registering on https://developer.sempra.com.
summary:
  types: [http]
  api_key_in: []
  oauth2_flows: []
  note: >-
    Scheme list is what the gateway demonstrates, not what a spec declares — Sempra
    publishes no OpenAPI, so nothing here is derived from a contract.
security_schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearer_format: OAuth 2.0 access token (Apigee OAuthV2)
  in: header
  header: Authorization
  method: probed
  evidence:
    request: GET https://api.sempra.com/v1/graphql
    status: 401
    www_authenticate: >-
      Bearer realm="null",error="invalid_token",error_description="oauth.v2.InvalidAccessToken:
      Invalid access token"
    body: '{"fault":{"faultstring":"Invalid access token","detail":{"errorcode":"oauth.v2.InvalidAccessToken"}}}'
  note: >-
    RFC 6750 bearer challenge emitted by an Apigee OAuthV2 VerifyAccessToken policy.
oauth2:
  detected: true
  detection: Apigee OAuthV2 VerifyAccessToken policy (oauth.v2.InvalidAccessToken fault)
  token_endpoint: null
  authorization_endpoint: null
  grant_types: []
  scopes: []
  note: >-
    No token, authorization or discovery endpoint is reachable anonymously.
    /.well-known/oauth-authorization-server and /.well-known/oauth-protected-resource
    both return the Apigee not-routed 404 on api.sempra.com; /oauth/token is not routed;
    /v1/token is routed but rejects at the OAuth policy before any grant is processed.
    Grant types and scopes are undocumented publicly, so scopes/ is deliberately not
    written — there is nothing real to put in it.
transport:
  tls: true
  tls_version: TLSv1.2
  hsts: max-age=31536000 (observed on the /v1 proxy response)
  content_security_policy: "script-src 'self'; child-src 'self'; form-action 'self'"
  cors:
    access_control_allow_origin: '*'
    access_control_allow_headers: '*'
    access_control_allow_methods: GET, PUT, POST, DELETE, OPTIONS, PATCH
    access_control_max_age: 3628800
    note: >-
      A permissive wildcard CORS policy advertising six HTTP methods, which indicates a
      browser-callable read/write surface behind the token.