University Of Gothenburg Authentication

# x-method: derived
# x-source-url: https://ws.spraakbanken.gu.se/docs/
# Written by API Evangelist for the api-evangelist/university-of-gothenburg repo on
# 2026-09-01. `x-method` uses the provenance-manifest vocabulary; the artifact's own
# `method:` key uses the enrichment-contract vocabulary. They are not in conflict.
generated: '2026-09-01'
method: probed
source: >-
  Anonymous live requests on 2026-09-01 against every surface listed below, plus the
  securitySchemes declared in each of the six Språkbanken Text OpenAPI documents stored under
  openapi/_original/.
description: >-
  Authentication posture per surface, split by operator. The finding worth stating plainly:
  every public read surface the University of Gothenburg operates answered an ANONYMOUS request
  with HTTP 200. There is no API key to obtain, no registration flow, no developer account and
  no published rate limit anywhere in this profile. Authorisation exists in exactly one place —
  Mink, where writing your own corpus requires a token — and that login rides on the same
  SWAMID/eduGAIN federation the institution operates its own IdP inside of.
surfaces:
  - name: Korp API v8
    url: https://ws.spraakbanken.gu.se/ws/korp/v8
    x-operator: institution
    type: none
    verified: '2026-09-01'
    detail: >-
      Anonymous GET /info returned HTTP 200 application/json, 25,974 bytes, listing 1,133 corpora.
      The specification declares a `basicAuth` HTTP Basic scheme applied globally, but it gates
      access to PROTECTED corpora only: unauthenticated callers get the open corpora and the full
      query, count, statistics and word-picture command set. No sign-up is published for the
      protected tier.
  - name: Språkbanken Text Metadata API v3
    url: https://ws.spraakbanken.gu.se/ws/metadata/v3
    x-operator: institution
    type: none
    verified: '2026-09-01'
    detail: >-
      No securitySchemes declared at all. Anonymous GET / returned HTTP 200 with 2,531,491 bytes
      of catalogue JSON; GET /list-ids returned 200 with 1,499 resource ids. Fully open read.
  - name: Karp API v7 (editing mode)
    url: https://spraakbanken4.it.gu.se/karp/v7
    x-operator: institution
    type: bearer + api-key (declared, not required for read)
    verified: '2026-09-01'
    detail: >-
      Declares `APIKeyQuery` and `HTTPBearer` securitySchemes. Anonymous GET /resources/ returned
      HTTP 200 with 1,042,817 bytes, so the read surface is open; the declared schemes gate the
      write and history operations. No key-issuance flow is published.
  - name: Karp search API v1 (Karps sökgränssnitt)
    url: https://spraakbanken4.it.gu.se/karps/v1
    x-operator: institution
    type: none
    verified: '2026-09-01'
    detail: >-
      Declares `HTTPBearer` and `APIKeyHeader` but applies neither to the three published
      operations. Anonymous GET /config returned HTTP 200 with 47,203 bytes describing 31
      lexical resources.
  - name: Sparv API v3
    url: https://ws.spraakbanken.gu.se/ws/sparv/v3
    x-operator: institution
    type: api-key (declared, not required for status operations)
    verified: '2026-09-01'
    detail: >-
      Declares an `ApiKeyAuth` scheme. Anonymous GET /ping returned HTTP 200
      {"message": "PONG", "time": 0.0041}, and GET / returned 200 with a structured
      {"error": {"message": "No input was found."}} rather than a 401 — so the service answers
      unauthenticated callers and rejects on input, not on identity, for the status surface.
  - name: Mink API v3
    url: https://ws.spraakbanken.gu.se/ws/mink/v3
    x-operator: institution
    type: oauth2 bearer + api-key header
    verified: '2026-09-01'
    detail: >-
      The only surface in this profile with a real authorisation model. Declares
      `OAuth2PasswordBearer` and `APIKeyHeader`. Anonymous GET /info returned HTTP 200 with the
      job status-code catalogue, so the informational surface is open, while the 63-path corpus
      create/upload/run/publish surface is token-gated. Mink's user accounts are federated
      logins, which is why the institution's own SWAMID IdP (below) is load-bearing for this API
      rather than incidental to it.
  - name: GUPEA DSpace 8 REST API
    url: https://gupea.ub.gu.se/server/api
    x-operator: institution
    type: none for read; token for write
    verified: '2026-09-01'
    detail: >-
      Anonymous GET returned HTTP 200 application/hal+json, 8,531 bytes, with
      "dspaceName": "GUPEA", "dspaceVersion": "DSpace 8.3-SNAPSHOT" and an `authn` link in
      `_links`. Stock DSpace: anonymous read of public items, JWT for write. The DSpace REST
      contract is the DSpace project's, not the University's, and is deliberately NOT stored
      under this slug — only the deployment is recorded.
  - name: GUPEA OAI-PMH 2.0
    url: https://gupea.ub.gu.se/server/oai/request
    x-operator: institution
    type: none
    verified: '2026-09-01'
    detail: Anonymous. OAI-PMH has no authentication layer by design.
  - name: Shibboleth Identity Provider (SWAMID / eduGAIN)
    url: https://idp3.it.gu.se/idp/shibboleth
    x-operator: federation
    type: saml2
    verified: '2026-09-01'
    detail: >-
      The University's own Shibboleth SAML 2.0 IdP, scope `gu.se`, published as signed metadata
      through the SWAMID MDQ service (HTTP 200 application/samlmetadata+xml, 13,045 bytes). SSO
      endpoints at /idp/profile/SAML2/POST/SSO and /idp/profile/SAML2/Redirect/SSO. This is not
      an API the University sells; it is the identity surface everything else in Swedish higher
      education authenticates against, and it is machine-readable.
  - name: Microsoft AD FS identity provider
    url: http://idp.auth.gu.se/adfs/services/trust
    x-operator: federation
    type: ws-trust / saml2
    verified: '2026-09-01'
    detail: >-
      A second University of Gothenburg entity in the SWAMID aggregate, DisplayName "University
      of Gothenburg (ADFS)". Registered by the institution; the AD FS product is Microsoft's.
      Recorded, not scored as a contract.
  - name: Microsoft 365 / SharePoint staff portal
    url: https://medarbetarportalen.gu.se/
    x-operator: tenant
    type: oauth2 (Microsoft Entra ID)
    verified: '2026-09-01'
    detail: >-
      Redirects to login.microsoftonline.com with Entra tenant id
      0798ed31-f5b0-4935-863c-73ee2505806e and resource gunet.sharepoint.com. A Microsoft tenancy
      on a University hostname. Recorded as a relationship; no Microsoft contract is stored here.