Unsw Sydney Authentication

---
name: UNSW Sydney — authentication posture by surface
aid: unsw-sydney
generated: '2026-08-19'
method: probed
source:
  - https://apideveloper.unsw.edu.au/getting-started
  - https://apideveloper.unsw.edu.au/signin
  - https://unsworks.unsw.edu.au/server/api
  - https://unsworks.unsw.edu.au/server/api/core/items?size=1
  - https://unsworks.unsw.edu.au/server/api/core/bitstreams?size=1
  - https://unsworks.unsw.edu.au/oai/request?verb=Identify
  - https://aaf.unsw.edu.au/idp/shibboleth
description: >-
  How each UNSW surface authenticates, established by probing rather than by reading marketing
  copy. The institution's most substantial API platform is fully gated; its readable surfaces are
  anonymous; and its own identity plane is a federated SAML IdP rather than an API key system.
surfaces:
  - surface: UNSW Enterprise Developer Portal / Enterprise API Gateway
    host: apideveloper.unsw.edu.au
    x-operator: institution
    scheme: gated — request-based authorisation, then Azure API Management subscription keys
    self_service_signup: false
    evidence:
      - url: https://apideveloper.unsw.edu.au/signin
        status: 200
        detail: Sign-in page only; there is no self-service registration path.
      - url: https://apideveloper.unsw.edu.au/getting-started
        status: 200
        detail: >-
          The portal's own onboarding text states that consumers must complete a registration form
          and may need to supply "a DSA or approval from an authorised personnel"; that credentials
          are issued by the integration team; and explicitly that "you will not be able to try out
          the APIs in the Developer Portal, due to security constraints of the organisation."
          Separate production-credential request forms exist for providers and consumers.
      - url: https://apideveloper.unsw.edu.au/apis
        status: 404
        detail: No public API catalogue is exposed; the catalogue is visible only after sign-in.
    notes: >-
      No base URL for the gateway itself is publicly disclosed anywhere on the portal. The
      apideveloper hostname and api.unsw.edu.au share an IP (20.248.141.24); api.unsw.edu.au
      itself returns 502 to unauthenticated requests and is not a documented public surface.
  - surface: UNSWorks Repository REST API (DSpace 7.0)
    host: unsworks.unsw.edu.au
    x-operator: institution
    scheme: anonymous read for discovery; session/JWT required for object browse endpoints
    self_service_signup: n/a
    evidence:
      - url: https://unsworks.unsw.edu.au/server/api
        status: 200
        detail: Service document readable with no credentials.
      - url: https://unsworks.unsw.edu.au/server/api/discover/search/objects?size=1
        status: 200
        detail: Discovery search readable with no credentials — the practical public entry point.
      - url: https://unsworks.unsw.edu.au/server/api/core/communities?size=2
        status: 200
      - url: https://unsworks.unsw.edu.au/server/api/core/collections?size=1
        status: 200
      - url: https://unsworks.unsw.edu.au/server/api/core/items?size=1
        status: 401
        detail: >-
          Unbounded item browse is gated. This is an access-clarity finding, not a failure: the
          repository is publicly harvestable via discovery search and OAI-PMH, but the item
          browse endpoint is not open.
      - url: https://unsworks.unsw.edu.au/server/api/core/bitstreams?size=1
        status: 401
    notes: >-
      DSpace exposes an authn endpoint at /server/api/authn; no credential issuance process for
      external developers is documented publicly.
  - surface: UNSWorks OAI-PMH
    host: unsworks.unsw.edu.au
    x-operator: institution
    scheme: none — fully anonymous
    evidence:
      - url: https://unsworks.unsw.edu.au/oai/request?verb=Identify
        status: 200
        detail: All six OAI-PMH verbs answered anonymously; no key, token or referrer required.
  - surface: UNSW Shibboleth Identity Provider (AAF / eduGAIN)
    host: aaf.unsw.edu.au
    x-operator: institution
    scheme: SAML 2.0 federated single sign-on (Shibboleth IdP)
    evidence:
      - url: https://aaf.unsw.edu.au/idp/shibboleth
        status: 200
        detail: >-
          Entity metadata is served anonymously and is itself the machine-readable contract.
          SSO endpoints require a valid SAML AuthnRequest from a federated service provider;
          they are not an open API and were not exercised.
    notes: >-
      This is the institution's own identity plane and the reason a university's most reliable
      programmable surface is often federation metadata rather than a REST API.
  - surface: Moodle @ UNSW (TELT) LTI 1.3 platform
    host: moodle.telt.unsw.edu.au
    x-operator: tenant
    scheme: OAuth 2.0 client credentials over LTI 1.3 (JWKS-published RS256 keys)
    evidence:
      - url: https://moodle.telt.unsw.edu.au/mod/lti/certs.php
        status: 200
        detail: Public keyset served anonymously.
      - url: https://moodle.telt.unsw.edu.au/mod/lti/token.php
        status: 400
        detail: Token endpoint present; rejects a request with no grant, which confirms it is live.
      - url: https://moodle.telt.unsw.edu.au/webservice/rest/server.php
        status: 200
        detail: >-
          Moodle web-service endpoint returns an in-band invalidtoken exception; token issuance is
          internal to UNSW and not available to external developers.