Uplight Authentication

generated: '2026-07-27'
method: probed
source: >-
  Live anonymous probes of https://api.uplight.com (2026-07-27). Not derived from an
  OpenAPI — this repo has none — and not searched from docs, because Uplight publishes no
  public authentication page.
documented_publicly: false
summary:
  types:
  - http-bearer
  api_key_in: []
  oauth2_flows: []
  note: >-
    The only observable fact is that the production gateway demands a bearer token. The
    grant type (client credentials, authorization code, or an issued static token) could
    not be determined anonymously.
schemes:
- name: bearerToken
  type: http
  scheme: bearer
  bearerFormat: unknown
  sources:
  - probe:https://api.uplight.com/
  evidence: >-
    HTTP 401 with body {"errors":[{"message":"Invalid or no token provided"}]} and
    response header server: kong/3.10.0.6-enterprise-edition. Returned for /, /v1,
    /openapi.json, /swagger.json, /mcp, and every /.well-known/ path — the gateway
    rejects before routing, so the 401 describes the edge policy, not any one operation.
discovery:
  openid_configuration: false
  oauth_authorization_server: false
  probes:
  - url: https://api.uplight.com/.well-known/openid-configuration
    status: 401
  - url: https://api.uplight.com/.well-known/oauth-authorization-server
    status: 401
  - url: https://api.uplight.com/.well-known/oauth-protected-resource
    status: 401
  - url: https://uplight.com/.well-known/openid-configuration
    status: 404
  - url: https://docs.uplight.com/.well-known/openid-configuration
    status: 404
  - url: https://auth.uplight.com/.well-known/openid-configuration
    status: '000'
    note: DNS does not resolve.
  - url: https://login.uplight.com/
    status: '000'
    note: DNS does not resolve.
credential_issuance:
  self_serve: false
  gate: partner-only
  note: >-
    Credentials are issued through a commercial relationship — a utility customer or
    contracted ecosystem partner is granted access to the ReadMe portal at
    docs.uplight.com. No public sign-up, no key-issuance form, no sandbox, no trial.
pointer_note: >-
  Deliberately NOT wired as type Authentication in apis.yml. That pointer feeds the
  "authentication documented" check, and Uplight documents nothing publicly — this file
  records what a probe could observe from outside, not a provider-published auth guide.
  Wire the pointer only if Uplight opens an authentication page.