University Of Wisconsin Madison Authentication

generated: '2026-08-19'
method: derived
source: openapi/university-of-wisconsin-madison-oauth-api-openapi.yml
docs: https://git.doit.wisc.edu/interop/external-docs/api-publisher-documentation
x-operator: institution
summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [clientCredentials]
  note: >-
    UW-Madison runs two entirely separate authentication planes and conflating them is the
    easiest mistake to make here. The API plane (api.wisc.edu, Google Apigee, org
    doit-ipt-apigee-prod-ce29) is OAuth 2.0 client-credentials only — machine-to-machine, no
    user context, no OIDC discovery. The human plane (login.wisc.edu) is a UW-operated
    Shibboleth IdP speaking SAML 2.0 and OIDC for campus SSO. No published API contract
    references the login.wisc.edu issuer.
schemes:
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  token_url: https://api.wisc.edu/oauth/token
  declared_scopes: []
  used_by: >-
    10 of 12 contracts — Person, Mock Person, Mock Person Certificates, HR, Mock HR, Manifest,
    Mock Manifest, Finance, Locations, and (by documentation, not by scheme) Enterprise Billing.
  purpose: Bearer access token for every gated UW-Madison enterprise API.
- name: basicAuth
  type: http
  scheme: basic
  used_by: openapi/university-of-wisconsin-madison-oauth-api-openapi.yml
  purpose: >-
    Presents the client_id/client_secret pair to POST https://api.wisc.edu/oauth/token in
    exchange for an access token. The OAuth contract notes that enabling the OAuth API product
    is not itself necessary in order to obtain tokens.
- name: none
  type: none
  used_by: >-
    openapi/university-of-wisconsin-madison-course-search-api-openapi.yml
    (public.enroll.wisc.edu) — fully open, no credential of any kind. Verified by an
    unauthenticated POST returning 226 and 932 course records.
onboarding:
  self_service: false
  detail: >-
    Access to production APIs is granted, not signed up for. The Person API access page
    documents an institutional access request, and every API product in the portal catalog
    carries approvalType "manual". A UW NetID is required to sign in to the developer portal at
    all, so the credential path is closed to anyone outside the institution.
  gated_by: institutional access request + manual approval per API product
  request_url: https://developer.wisc.edu/person-api/getting-access
  contact: api@doit.wisc.edu
mocks:
  detail: >-
    UW-Madison publishes openly readable MOCK variants on mock.api.wisc.edu for four of its
    gated APIs (Person, Person Certificates, HR, Manifest). This is a deliberate and unusually
    good practice for a university: the contract and the shape of the data are public even
    though the production data is not.
  hosts: [https://mock.api.wisc.edu]
identity_federation:
  operator: institution
  entity_id: https://login.wisc.edu/idp/shibboleth
  saml_metadata: https://login.wisc.edu/idp/shibboleth
  oidc_discovery: https://login.wisc.edu/.well-known/openid-configuration
  scope: wisc.edu
  detail: >-
    Institution-operated Shibboleth IdP serving both SAML 2.0 and OpenID Connect. Governs campus
    SSO and the vendor tenants (Canvas), not the API gateway.