University Of York Authentication

# authorship: generated by API Evangelist from live probes of the operator's own endpoints.
# The document is ours; the facts in it were measured, not claimed. `method: probed` below
# records HOW it was obtained; this header records WHO wrote it. An unmarked artifact would
# be credited to the institution as though they published it, and they did not.
specification: API Commons Authentication
specificationVersion: '0.1'
provider: University of York
providerId: university-of-york
generated: '2026-08-30'
method: probed
description: >-
  How the University of York's institution-operated API surfaces authenticate — which is, on every
  one of them, not at all. All three contracts in this repository answer unauthenticated GET
  requests from an arbitrary client with no key, no token, no registration and no referer check.
  That is recorded as a positive fact about access clarity, not as a gap. Where authentication IS
  required at York it sits on surfaces this repository does not describe, and those are listed
  under out_of_scope below so the absence of a key here is not mistaken for the whole picture.
sources:
  - https://discover.york.ac.uk/api/search-simple?q=york&size=1
  - https://discover.york.ac.uk/iiif/3/ark:/36941/common/objects/uoy-logo/info.json
  - https://pure.york.ac.uk/ws/oai?verb=Identify
  - https://pure.york.ac.uk/ws/api/524/openapi.json

surfaces:
  - name: University of York Digital Collections Search API
    contract: openapi/university-of-york-digital-collections-search-openapi.yml
    operator: institution
    scheme: none
    registration: none
    key_issuance: none
    verified:
      - url: https://discover.york.ac.uk/api/search-simple?q=york&page=1&size=2
        status: 200
        note: keyless GET from an unregistered client
    cors:
      access-control-allow-origin: '*'
      access-control-allow-methods: 'OPTIONS,GET'
      access-control-allow-headers: 'Content-Type'
      note: Browser and agent clients can call this directly from any origin.

  - name: University of York Digital Collections IIIF APIs
    contract: openapi/university-of-york-digital-collections-iiif-openapi.yml
    operator: institution
    scheme: none
    registration: none
    verified:
      - url: https://discover.york.ac.uk/iiif/3/ark:/36941/common/objects/uoy-logo/info.json
        status: 200
      - url: https://discover.york.ac.uk/ark:/36941/9952973300001381/presentation/3/manifest
        status: 200
    note: >-
      No IIIF Authentication API 2.0 service is declared on any served resource. Access control on
      unknown identifiers is enforced by the object store and surfaces as HTTP 403 AccessDenied.

  - name: University of York Research Portal OAI-PMH
    contract: openapi/university-of-york-research-portal-oai-pmh-openapi.yml
    operator: institution
    scheme: none
    registration: none
    verified:
      - url: https://pure.york.ac.uk/ws/oai?verb=Identify
        status: 200
    note: Open harvesting, per OAI-PMH convention. No rate-limit or throttling headers were observed.

out_of_scope:
  - name: Elsevier Pure Web Services REST API
    url: https://pure.york.ac.uk/ws/api
    operator: tenant
    scheme: api_key
    verified:
      - url: https://pure.york.ac.uk/ws/api/documentation/index.html
        status: 200
        note: vendor documentation index reachable without a key
      - url: https://pure.york.ac.uk/ws/api/524/openapi.json
        status: 401
        note: the versioned API itself refuses an unauthenticated call
    note: >-
      Elsevier's contract running on York's tenant host. Keys are issued by the institution's Pure
      administrators, not self-service. Deliberately not described in this repository.
  - name: Ex Libris Primo / Alma (YorSearch)
    url: https://yorsearch.york.ac.uk/discovery/search?vid=44YORK_INST:NUI
    operator: tenant
    scheme: api_key
    note: Programmatic access runs through Ex Libris's own developer network on api-eu.hosted.exlibrisgroup.com; keys are Ex Libris's to issue.
  - name: University of York institutional sign-on
    url: https://shib.york.ac.uk/idp/profile/SAML2/Redirect/SSO
    operator: institution
    scheme: saml2
    note: >-
      Shibboleth SAML 2.0 IdP. This is the authentication surface through which every bought
      platform is reached. It is not an API a third party can call; it is recorded here because it
      is the institution's own identity infrastructure and its conformance evidence lives in
      conformance/university-of-york-conformance.yml.
  - name: api.york.ac.uk
    url: https://api.york.ac.uk/
    operator: institution
    scheme: network_restricted
    verified:
      - url: https://api.york.ac.uk/
        status: 403
        note: 'serves the University''s own branded error page titled "403 local - University of York" — an institution-operated host that refuses clients outside the campus network'
    note: >-
      A real institution-operated API host that is not publicly callable. It is recorded so that
      the absence of a public developer portal is not read as the absence of internal APIs.