Ucla Authentication

generated: '2026-08-19'
method: probed
source: >-
  securityDefinitions read verbatim from the seven OpenAPI documents UCLA publishes at
  https://developer.api.ucla.edu/sites/default/files/apidoc_specs/ (all HTTP 200);
  https://api.ucla.edu/sis/dictionary/buildings/v1 (401, Apigee OAuth fault);
  https://api.ucla.edu/oauth/client_credential/accesstoken (200);
  https://mdq.incommon.org/entities/urn%3Amace%3Aincommon%3Aucla.edu (200, signed SAML metadata);
  https://bruinlearn.ucla.edu/api/v1/accounts (401) — all fetched 2026-08-19
provider: University of California, Los Angeles
providerId: ucla
description: >-
  Authentication posture across every UCLA surface reachable from the open internet. UCLA is
  unusual for this cohort: it runs a real, centrally governed API program with one gateway, one
  documented credential model and one authorization server, all under ucla.edu. What it does
  not run is a self-service path — every credential is issued by request through the developer
  portal, and the portal itself signs in through the campus Shibboleth IdP.
schemes:
- name: UCLA API Gateway OAuth 2.0 (client credentials)
  type: oauth2
  x-operator: institution
  flow: application
  token_endpoint: https://api.ucla.edu/oauth/client_credential/accesstoken?grant_type=client_credentials
  gateway: Google Apigee Edge (api.ucla.edu CNAMEs to ucla-prod.apigee.net)
  declared_in:
  - openapi/_original/ucla-sis-classes-openapi.yml
  - openapi/_original/ucla-sis-courses-openapi.yml
  - openapi/_original/ucla-sis-dictionary-openapi.yml
  - openapi/_original/ucla-sis-production-calendar-jobs-openapi.yml
  - openapi/_original/ucla-sis-verify-connectivity-openapi.yml
  - openapi/_original/ucla-myucla-menu-data-openapi.yml
  scopes:
  - read
  - write
  credential_issuance: >-
    App Key and App Secret, issued after an access request is approved in the developer portal.
    Developers create an App, choose one or more API Products, and the owning campus unit
    approves. There is no public or dynamic client registration.
  observed_enforcement: >-
    HTTP 401 with {"fault":{"faultstring":"Invalid access token","detail":{"errorcode":
    "oauth.v2.InvalidAccessToken"}}} on a documented SIS route with no token present.
  pkce_advertised: false
  discovery_document: none
  notes: >-
    The contracts declare only `read` and `write` as scopes, across all six SIS products. There
    is no per-product or per-resource scope, so an approved credential is coarse by design and
    the real access boundary is the API Product an app is subscribed to, not the token scope.
- name: UCLA API Gateway API key (header)
  type: apiKey
  x-operator: institution
  in: header
  parameter: x-apikey
  declared_in:
  - openapi/_original/ucla-weather-openapi.yml
  observed_enforcement: HTTP 401 on https://api.ucla.edu/weather/api with no key present.
  notes: >-
    The UCLA Weather contract is the only one of the seven that uses a header API key rather
    than OAuth 2.0, and the only one written in OpenAPI 3.0.3 rather than Swagger 2.0. Two
    credential models on one gateway is an inconsistency worth flagging, not a defect in either.
- name: UCLA Shibboleth identity provider (SAML 2.0 / SAML 1.1)
  type: saml
  x-operator: institution
  entity_id: urn:mace:incommon:ucla.edu
  metadata_url: https://mdq.incommon.org/entities/urn%3Amace%3Aincommon%3Aucla.edu
  registration_authority: https://incommon.org
  scope: ucla.edu
  sso_endpoints:
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
    location: https://shb.ais.ucla.edu/shibboleth-idp/profile/SAML2/POST/SSO
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
    location: https://shb.ais.ucla.edu/shibboleth-idp/profile/SAML2/Redirect/SSO
  - binding: urn:mace:shibboleth:1.0:profiles:AuthnRequest
    location: https://shb.ais.ucla.edu/shibboleth-idp/profile/Shibboleth/SSO
  attribute_authority:
  - binding: urn:oasis:names:tc:SAML:2.0:bindings:SOAP
    location: https://shb.ais.ucla.edu:8443/shibboleth-idp/profile/SAML2/SOAP/AttributeQuery
  - binding: urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding
    location: https://shb.ais.ucla.edu:8443/shibboleth-idp/profile/SAML1/SOAP/AttributeQuery
  entity_categories:
  - http://id.incommon.org/category/research-and-scholarship
  - http://refeds.org/category/research-and-scholarship
  - http://id.incommon.org/category/registered-by-incommon
  assurance_certification:
  - https://refeds.org/sirtfi
  security_contact: security@it.ucla.edu
  notes: >-
    This is the credential every UCLA human authentication path ultimately terminates at,
    including sign-in to the developer portal itself (/saml_login). It is machine-readable,
    signed, and federated into eduGAIN through InCommon — the single most under-catalogued
    institution-operated API surface class in higher education.
- name: BruinLearn (Canvas) OAuth 2.0 and LTI 1.3
  type: oauth2
  x-operator: tenant
  observed_enforcement: >-
    HTTP 401 {"status":"unauthenticated","errors":[{"message":"user authorization required"}]}
    on https://bruinlearn.ucla.edu/api/v1/accounts.
  public_metadata: https://bruinlearn.ucla.edu/api/lti/security/jwks
  notes: >-
    UCLA's students and courses, Instructure's authorization server and contract. Recorded as
    a relationship; no Canvas contract is saved under this institution.
unauthenticated_surfaces:
- url: https://mdq.incommon.org/entities/urn%3Amace%3Aincommon%3Aucla.edu
  x-operator: institution
  note: Signed SAML metadata, anonymously readable.
- url: https://developer.api.ucla.edu/sites/default/files/apidoc_specs/
  x-operator: institution
  note: >-
    Seven OpenAPI documents, anonymously readable. The portal gates the interactive console
    behind campus sign-in but does not gate the underlying specification files.
- url: https://bruinlearn.ucla.edu/api/lti/security/jwks
  x-operator: tenant
  note: LTI 1.3 platform JWKS, anonymously readable.
self_service: false
self_service_note: >-
  No UCLA API can be reached by an unaffiliated developer. Every credential path requires a
  UCLA logon, and the portal states that "Most APIs, except those available for public
  consumption, are only visible after log on."
support_contact: api-support@it.ucla.edu
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com