True Footage Authentication

generated: '2026-08-05'
method: probed
source: https://auth.truetracts.truefootage.tech/.well-known/openid-configuration
description: >-
  True Footage publishes no developer documentation and no OpenAPI, so this profile is
  built entirely from the two OpenID Connect discovery documents its identity hosts serve
  anonymously, plus the observed behaviour of the two product API hosts. Both product
  surfaces (TrueTracts and TrueEngine) sit behind an Auth0 custom identity domain; the
  product APIs themselves reject every unauthenticated request at the edge.
summary:
  model: oauth2-oidc
  provider: Auth0 (custom identity domains under truefootage.tech)
  public_api_program: false
  note: >-
    These are the tenant-facing sign-in surfaces for True Footage's own SaaS products,
    not a documented third-party API program. No client registration flow, scope
    reference, or key-issuance page is published publicly.
schemes:
  - key: truetracts_oidc
    type: openIdConnect
    openIdConnectUrl: https://auth.truetracts.truefootage.tech/.well-known/openid-configuration
    issuer: https://auth.truetracts.truefootage.tech/
    applies_to: TrueTracts appraiser console (truetracts.truefootage.tech) and api.truetracts.truefootage.tech
    endpoints:
      authorization: https://auth.truetracts.truefootage.tech/authorize
      token: https://auth.truetracts.truefootage.tech/oauth/token
      userinfo: https://auth.truetracts.truefootage.tech/userinfo
      jwks: https://auth.truetracts.truefootage.tech/.well-known/jwks.json
      revocation: https://auth.truetracts.truefootage.tech/oauth/revoke
      registration: https://auth.truetracts.truefootage.tech/oidc/register
      device_authorization: https://auth.truetracts.truefootage.tech/oauth/device/code
      mfa_challenge: https://auth.truetracts.truefootage.tech/mfa/challenge
    x-evidence:
      fetched: '2026-08-05'
      url: https://auth.truetracts.truefootage.tech/.well-known/openid-configuration
      http_status: 200
      content_type: application/json
      file: well-known/true-footage-truetracts-openid-configuration.json
  - key: trueengine_oidc
    type: openIdConnect
    openIdConnectUrl: https://auth.trueengine.truefootage.tech/.well-known/openid-configuration
    issuer: https://auth.trueengine.truefootage.tech/
    applies_to: TrueEngine (trueengine.truefootage.tech) and api.trueengine.truefootage.tech
    endpoints:
      authorization: https://auth.trueengine.truefootage.tech/authorize
      token: https://auth.trueengine.truefootage.tech/oauth/token
      userinfo: https://auth.trueengine.truefootage.tech/userinfo
      jwks: https://auth.trueengine.truefootage.tech/.well-known/jwks.json
    x-evidence:
      fetched: '2026-08-05'
      url: https://auth.trueengine.truefootage.tech/.well-known/openid-configuration
      http_status: 200
      content_type: application/json
      file: well-known/true-footage-trueengine-openid-configuration.json
capabilities:
  pkce:
    supported: true
    code_challenge_methods: [S256, plain]
  grant_types:
    - client_credentials
    - authorization_code
    - refresh_token
    - password
    - implicit
    - 'urn:ietf:params:oauth:grant-type:device_code'
    - 'urn:ietf:params:oauth:grant-type:token-exchange'
    - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
  token_endpoint_auth_methods:
    - client_secret_basic
    - client_secret_post
    - private_key_jwt
    - none
  id_token_signing_alg_values: [HS256, RS256, PS256]
  mfa: true
  note_scopes: >-
    scopes_supported advertises only the fourteen standard OIDC identity scopes
    (openid, profile, offline_access, email, phone, address and the individual claim
    scopes). These are Auth0 tenant defaults, not a designed API permission surface —
    no product-specific scopes are published, so no scopes/ artifact is emitted.
access:
  status: gated
  observed:
    - url: https://api.truetracts.truefootage.tech/
      http_status: 401
      body: '{"detail":"authorization header is expected"}'
    - url: https://api.truetracts.truefootage.tech/openapi.json
      http_status: 401
    - url: https://api.trueengine.truefootage.tech/openapi.json
      http_status: 401
    - url: https://api.truetracts.truefootage.tech/health
      http_status: 200
      body: '{}'
  note: >-
    Both product APIs reject unauthenticated requests uniformly, including the spec and
    docs paths a FastAPI-shaped service would normally serve anonymously. Credentials are
    issued through the product signup, not through a developer program.
gaps:
  - No public developer portal, API reference, or key-issuance page.
  - No machine-readable contract (OpenAPI/GraphQL/AsyncAPI) reachable without a token.
  - >-
    No /.well-known/oauth-protected-resource on either API host, so an agent cannot
    discover which authorization server protects which resource.