Trestle Authentication

generated: '2026-07-26'
method: searched
source: >-
  https://trestle-documentation.corelogic.com/webapi.html (Authentication),
  https://trestle-documentation.corelogic.com/rets.html (Authentication),
  https://trestle-documentation.corelogic.com/participant-reporting-api.html,
  https://trestle-documentation.corelogic.com/direct-webapi-crm-reference.html,
  plus the live OIDC discovery document at
  https://api.cotality.com/trestle/oidc/.well-known/openid-configuration
  (saved verbatim at well-known/trestle-openid-configuration.json).
docs: https://trestle-documentation.corelogic.com/webapi.html
description: >-
  Trestle has no OpenAPI, so this profile is assembled from the published
  documentation and the live OIDC discovery document rather than derived from
  securitySchemes. One IdentityServer fronts every Trestle surface; the scope
  selects which product surface the credential is good for (api = Web API and
  Participant Reporting; rets = RETS). Credentials are issued only after a
  per-MLS data licence contract is executed, so the auth model is fully
  documented but not self-service.

summary:
  types: [oauth2, openIdConnect, http]
  oauth2_flows: [clientCredentials]
  http_schemes: [basic, bearer]
  api_key_in: []
  self_service_credentials: false
  credential_issuance: >-
    Register a Technology Provider or Broker account at
    https://trestle.corelogic.com, request a connection to each multiple listing
    organization, and complete an e-signed data licence contract signed by all
    parties. Credentials are scoped to a specific product/feed-type pair.

issuer:
  issuer: https://api.cotality.com
  discovery: https://api.cotality.com/trestle/oidc/.well-known/openid-configuration
  discovery_status: 200
  jwks_uri: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/.well-known/openid-configuration/jwks
  jwks_file: well-known/trestle-openid-jwks.json
  token_endpoint: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/connect/token
  documented_token_endpoint: https://api.cotality.com/trestle/oidc/connect/token
  authorization_endpoint: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/connect/authorize
  introspection_endpoint: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/connect/introspect
  revocation_endpoint: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/connect/revocation
  userinfo_endpoint: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/connect/userinfo
  device_authorization_endpoint: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/connect/deviceauthorization
  end_session_endpoint: https://trestle-auth-prd.kfusw1prd.solutions.corelogic.com/connect/endsession
  grant_types_supported: [authorization_code, client_credentials, refresh_token, implicit, 'urn:ietf:params:oauth:grant-type:device_code']
  token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post]
  id_token_signing_alg_values_supported: [RS256]
  code_challenge_methods_supported: [plain, S256]
  subject_types_supported: [public]
  claims_supported: []
  note: >-
    The documented token URL (api.cotality.com/trestle/oidc/connect/token) and
    the discovery-advertised endpoints point at different hostnames; the
    solutions.corelogic.com auth host does not resolve publicly, so integrators
    should use the documented api.cotality.com path.

schemes:
  - name: TrestleWebAPIOAuth2
    type: oauth2
    flow: clientCredentials
    token_url: https://api.cotality.com/trestle/oidc/connect/token
    request_content_type: application/x-www-form-urlencoded
    parameters: [client_id, client_secret, grant_type=client_credentials, scope=api]
    token_type: Bearer
    token_lifetime_seconds: 28800
    applies_to:
      - Trestle RESO Web API (https://api.cotality.com/trestle/odata)
      - Trestle Participant Reporting API (WebAPI feeds)
    sources: [https://trestle-documentation.corelogic.com/webapi.html]
  - name: TrestleRETSOAuth2
    type: oauth2
    flow: clientCredentials
    token_url: https://api.cotality.com/trestle/oidc/connect/token
    parameters: [client_id, client_secret, grant_type=client_credentials, scope=rets]
    token_type: Bearer
    applies_to:
      - Trestle RETS (https://api.cotality.com/trestle/rets)
      - Trestle Participant Reporting API (RETS feeds)
    note: scope=api is rejected on RETS credentials (documented 400).
    sources: [https://trestle-documentation.corelogic.com/rets.html]
  - name: TrestleRETSBasic
    type: http
    scheme: basic
    detail: Base64-encoded client_id:client_secret in the Authorization header.
    applies_to: [Trestle RETS]
    note: Digest authentication is explicitly NOT supported. RETS is session-less — the login endpoint need not be called before Search/GetObject.
    sources: [https://trestle-documentation.corelogic.com/rets.html]
  - name: TrestleDirectWebAPIOIDC
    type: openIdConnect
    detail: >-
      OpenID Connect against the same Trestle IdentityServer, with Clareity
      Single Sign-On authorization and HTTP Basic named as alternatives. Access
      is further constrained by the acting user's privileges inside Matrix.
    applies_to: [Trestle Direct Web API (Matrix CRM + MLO)]
    sources: [https://trestle-documentation.corelogic.com/direct-webapi-crm-reference.html]

token_usage:
  header: 'Authorization: Bearer <access_token>'
  response_fields: [access_token, expires_in, token_type]
  expires_in: 28800
  guidance: >-
    Documentation recommends caching the token and its expiry and refreshing
    only when necessary; a token is valid for up to 8 hours.

observed:
  - request: 'GET https://api.cotality.com/trestle/odata'
    status: 200
    note: OData service document answers anonymously.
  - request: 'GET https://api.cotality.com/trestle/odata/$metadata'
    status: 401
    note: 'www-authenticate: Bearer — the CSDL contract itself is gated.'
  - request: 'GET https://api.cotality.com/trestle/rets/login'
    status: 401