University Of Birmingham Authentication

generated: '2026-08-30'
method: probed
authorship: generated by API Evangelist from live probes; not authored by the institution.
source: live HTTP probes of edata/etheses/epapers.bham.ac.uk, idp2.bham.ac.uk, gitlab.bham.ac.uk and
  englishconstructicon.bham.ac.uk on 2026-08-30
description: >-
  Authentication posture across the surfaces the University of Birmingham actually operates. The
  University publishes no API key programme, no OAuth authorization server, no developer
  registration and no self-serve credential of any kind. Machine access to its own surfaces is
  either entirely unauthenticated (OAI-PMH harvesting, EPrints REST reads, the English Constructicon
  API, GitLab public project listings) or federated through the institution's own SAML identity
  provider, which is not obtainable by an unaffiliated caller.
summary:
  types:
    - none
    - saml
    - bearer
  api_key_in: []
  notes: >-
    Nothing here issues a credential to the public. The only bearer-token surface is the self-hosted
    GitLab, whose tokens are issued to members of the University, and whose keyless reach is limited
    to the public project listing.
schemes:
  - name: oai-pmh-anonymous
    type: none
    surface: UBIRA eData, UBIRA eTheses and ePapers OAI-PMH providers
    x-operator: institution
    description: >-
      All three EPrints OAI-PMH 2.0 providers answer unauthenticated over HTTPS. Verified against
      verb=Identify and verb=ListMetadataFormats on each host.
    sources:
      - https://edata.bham.ac.uk/cgi/oai2?verb=Identify
      - https://etheses.bham.ac.uk/cgi/oai2?verb=Identify
      - https://epapers.bham.ac.uk/cgi/oai2?verb=Identify
  - name: eprints-rest-anonymous
    type: none
    surface: EPrints REST interface (/rest/) on eData and eTheses
    x-operator: institution
    description: >-
      The EPrints REST dataset browser answers without credentials (HTTP 200, "EPrints REST:
      Datasets"), as does the OpenSearch description document and the JSON output of the advanced
      search CGI. Write operations require a repository account, which is issued to University
      depositors, not to developers.
    sources:
      - https://edata.bham.ac.uk/rest/
      - https://edata.bham.ac.uk/cgi/opensearchdescription
  - name: constructicon-anonymous
    type: none
    surface: English Constructicon API
    x-operator: institution
    description: >-
      GET /database/api/constructions and GET /database/api/constructions/{id}/ answer with no
      credential and no key. Response headers carry HSTS with preload, X-Content-Type-Options
      nosniff, X-Frame-Options DENY and a Permissions-Policy, and `Allow: GET, HEAD, OPTIONS` — the
      surface is read-only by design.
    sources:
      - https://englishconstructicon.bham.ac.uk/database/api/constructions
      - https://englishconstructicon.bham.ac.uk/database/api/
  - name: shibboleth-saml2
    type: saml
    surface: University of Birmingham Identity Provider
    x-operator: institution
    entityID: https://idp.bham.ac.uk/shibboleth
    metadata: https://idp2.bham.ac.uk/idp/shibboleth
    bindings:
      - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
      - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect
      - urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign
      - urn:oasis:names:tc:SAML:2.0:bindings:SOAP
      - urn:mace:shibboleth:1.0:profiles:AuthnRequest
    scopes:
      - bham.ac.uk
    federation: UK Access Management Federation
    description: >-
      Institutional single sign-on. Access is granted to federation members, not to self-serve
      developers; there is no path for an unaffiliated caller to obtain a credential. A separate
      development IdP, https://idpdev.bham.ac.uk/idp/shibboleth, is also registered in the
      federation.
    sources:
      - https://idp2.bham.ac.uk/idp/shibboleth
      - http://metadata.ukfederation.org.uk/ukfederation-metadata.xml
  - name: gitlab-personal-access-token
    type: bearer
    surface: BEAR GitLab REST API (/api/v4)
    x-operator: institution
    description: >-
      GET /api/v4/projects answers keyless with public projects; GET /api/v4/version returns
      {"message":"401 Unauthorized"} without a token. Authenticated access uses GitLab's standard
      PRIVATE-TOKEN / Bearer personal access tokens, issued to University accounts. The deployment
      is Birmingham's; the token scheme is GitLab's product behaviour.
    sources:
      - https://gitlab.bham.ac.uk/api/v4/projects?per_page=1
      - https://gitlab.bham.ac.uk/api/v4/version
tenant_surfaces:
  - surface: Elsevier Pure research portal (research.birmingham.ac.uk)
    x-operator: tenant
    detail: >-
      Pure web services are not open to unauthenticated callers here — /ws/api returns 404 and
      /ws/oai returns a 500 JSON envelope. Any Pure API key would be issued by Elsevier under the
      University's licence, not by the University.
  - surface: Ex Libris Primo discovery (findit.bham.ac.uk)
    x-operator: tenant
    detail: >-
      Primo APIs are issued through the Ex Libris Developer Network under the institution's
      subscription. Not a Birmingham-issued credential.
  - surface: Instructure Canvas (canvas.bham.ac.uk)
    x-operator: tenant
    detail: >-
      Canvas API tokens and LTI keys are issued inside the Instructure tenancy behind institutional
      login. Not a public developer surface.