University Of Copenhagen Authentication

generated: '2026-08-30'
method: derived
x-evidence-method: probed
x-evidence-note: >-
  Written by API Evangelist from live HTTP probes of the institution's own endpoints on
  2026-08-30; every status code and payload quoted below was observed, not inferred. `derived`
  is the provenance-manifest term for "we wrote it" — the provider did not publish this file.
source: https://curis.ku.dk/ws/oai
summary:
  types: []
  note: >-
    The one institution-operated contract Copenhagen publishes takes no credential at all.
    Every OAI-PMH verb was answered with HTTP 200 on an anonymous request from a residential
    IP with no header beyond a browser User-Agent. There is no securityScheme to declare
    because the repository does not operate one.
schemes: []
surfaces:
  - surface: CURIS OAI-PMH harvesting endpoint
    url: https://curis.ku.dk/ws/oai
    x-operator: institution
    auth: none
    evidence: >-
      All six OAI-PMH verbs returned 200 application/xml unauthenticated on 2026-08-30.
      robots.txt on the sibling portal advertises Crawl-Delay: 5; no rate-limit header was
      returned on any probe.
  - surface: Elsevier Pure Web Service (REST)
    url: https://curis.ku.dk/ws/api
    x-operator: tenant
    auth: api-key
    evidence: >-
      https://curis.ku.dk/ws/api returns 200 (HTML landing page, 19,723 bytes) but
      https://curis.ku.dk/ws/api/524/openapi.yaml returns 401. The contract exists and is
      gated; it is also Elsevier's document, not Copenhagen's, so it is not saved in this
      repo. Recorded as a tenant relationship in apis.yml instead.
  - surface: University of Copenhagen SAML 2.0 identity provider
    url: https://id.ku.dk/nidp/saml2/metadata
    x-operator: institution
    auth: saml2-websso
    evidence: >-
      Signed SAML 2.0 EntityDescriptor served at 200, 24,737 bytes, entityID
      https://id.ku.dk/nidp/saml2/metadata. The metadata document itself is public and
      unauthenticated — that is what makes it a machine-readable surface — while the SSO
      endpoints it advertises are the authentication mechanism for KUnet and ERDA.
  - surface: Windows AD FS federation endpoint
    url: https://federation.ku.dk/adfs/services/trust
    x-operator: institution
    auth: ws-federation
    evidence: >-
      Registered in the WAYF federation metadata but unreachable from the public internet —
      the connection timed out after 25s on 2026-08-30. Firewalled to campus/federation
      traffic. Recorded, not credited as a live pointer.