Us Dot Authentication

generated: '2026-07-28'
method: searched
source: >-
  openapi/us-dot-faa-safety-assurance-system-api-openapi.yml (securitySchemes),
  openapi/us-dot-faa-air-carrier-prd-api-openapi.yml (header parameters),
  https://api.faa.gov/s/, https://mobile.fmcsa.dot.gov/QCDevsite/,
  https://safetydata.fra.dot.gov/MasterWebService/FRASafetyDataAPIs.aspx,
  https://dev.socrata.com/docs/app-tokens.html, live probes 2026-07-28
summary:
  types:
  - none
  - apiKey
  api_key_in:
  - header
  - query
  oauth2_flows: []
  openid_connect: false
  mutual_tls: false
  detail: >-
    U.S. DOT uses NO OAuth 2.0 and NO OpenID Connect on any API. Every credentialed
    surface is a static key or key-pair sent in request headers. The majority of the
    department's API surface area requires no credential at all. There is no departmental
    identity layer for API consumers — Login.gov appears once, in front of FMCSA key
    issuance, not in front of an API.
  spec_gap: >-
    Only ONE of the five harvested specs declares securitySchemes at all (the FAA SAS
    API). The FAA PRD API sends its credentials as ordinary header PARAMETERS with no
    securityScheme and no security requirement, which is why a mechanical derive over
    securitySchemes alone misses it. Both are recorded below.
anonymous_surfaces:
- api: us-dot:faa-airport-status-web-service
  verified: '2026-07-28'
  evidence: 'GET https://external-api.faa.gov/asws/api/airport/status/JFK -> 200'
- api: us-dot:faa-aeronautic-product-release-api
  verified: '2026-07-28'
  evidence: 'GET https://external-api.faa.gov/apra/nfdc/nasr/info -> 200'
- api: us-dot:dot-data-hub-soda-api
  verified: '2026-07-28'
  note: Optional app token only; not authentication.
- api: us-dot:bts-open-data-soda-api
  verified: '2026-07-28'
- api: us-dot:faa-data-catalog-ckan-api
  verified: '2026-07-28'
  evidence: 'GET https://catalog.data.faa.gov/api/3/action/package_list -> 200'
- api: us-dot:nhtsa-vpic-api
  verified: '2026-07-28'
  evidence: 'GET https://vpic.nhtsa.dot.gov/api/vehicles/getallmakes?format=json -> 200, 12,306 makes'
- api: us-dot:nhtsa-safety-api
  verified: '2026-07-28'
  evidence: 'GET https://api.nhtsa.gov/complaints/complaintsByVehicle?make=honda&model=accord&modelYear=2020 -> 200'
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter: X-API-KEY
  applies_to: us-dot:faa-safety-assurance-system-api
  sources:
  - openapi/us-dot-faa-safety-assurance-system-api-openapi.yml
  note: >-
    Declared as a securityScheme but NOT applied — the spec has no top-level or
    operation-level `security` block, so generated clients omit it and get a gateway 401.
- name: appId
  type: apiKey
  in: header
  parameter: X-APP-ID
  applies_to: us-dot:faa-safety-assurance-system-api
  sources:
  - openapi/us-dot-faa-safety-assurance-system-api-openapi.yml
  note: Required alongside X-API-KEY. Same non-application problem.
- name: clientIdHeader
  type: apiKey
  in: header
  parameter: client_id
  applies_to: us-dot:faa-air-carrier-prd-api
  sources:
  - openapi/us-dot-faa-air-carrier-prd-api-openapi.yml
  note: >-
    Declared as a REQUIRED header parameter on every operation, not as a securityScheme.
    Paired with client_secret. An OAuth-shaped credential pair with no OAuth protocol —
    no token endpoint, no expiry, no scopes, no refresh.
- name: clientSecretHeader
  type: apiKey
  in: header
  parameter: client_secret
  applies_to: us-dot:faa-air-carrier-prd-api
  sources:
  - openapi/us-dot-faa-air-carrier-prd-api-openapi.yml
- name: socrataAppToken
  type: apiKey
  in: header
  parameter: X-App-Token
  alternate:
    in: query
    parameter: $$app_token
  applies_to: [us-dot:dot-data-hub-soda-api, us-dot:bts-open-data-soda-api]
  optional: true
  docs: https://dev.socrata.com/docs/app-tokens.html
  note: >-
    NOT authentication. An application token identifies the calling application so
    Socrata can apply a per-application throttle instead of the shared anonymous pool.
    Every read works without it. Issued self-serve at
    https://data.transportation.gov/profile/edit/developer_settings.
- name: fmcsaWebKey
  type: apiKey
  in: query
  parameter: webKey
  applies_to: us-dot:fmcsa-qcmobile-api
  docs: https://mobile.fmcsa.dot.gov/QCDevsite/docs/apiAccess
  note: >-
    Free, self-serve — the only self-serve API credential in the department. Requires a
    Login.gov account to obtain. Login.gov is the federal OIDC identity provider, but it
    gates key ISSUANCE, not the API itself; FMCSA exposes no OIDC discovery document.
- name: fraWebServiceAccount
  type: http
  scheme: unspecified
  applies_to: us-dot:fra-safety-data-api
  docs: https://safetydata.fra.dot.gov/MasterWebService/FRASafetyDataAPIs.aspx
  note: >-
    A "web service account" requested by emailing RsisSupport@dot.gov. Two separate
    request types — one for the full Data Download service, one for the Lite API. Neither
    WSDL declares a WS-Security policy; the credential model is not published.
- name: odeOperatorDefined
  type: none
  applies_to: us-dot:its-jpo-ode-rest-api
  note: >-
    The ODE Swagger 2.0 document declares no securityDefinitions. Authentication is
    whatever the deploying operator puts in front of it. Given this API writes to physical
    roadside units, that absence is the finding.
credential_issuance:
- portal: https://api.faa.gov/s/
  covers: [us-dot:faa-air-carrier-prd-api, us-dot:faa-safety-assurance-system-api]
  self_serve: false
  gate: FAA operator accreditation (14 CFR Part 121/135/125/91K/Air Tour/Public Aircraft/91 Corporate for PRD)
  guide: https://www.faa.gov/regulationspolicies/pilotrecordsdatabase/air-carrier-api-discover-learn-get-access
- portal: https://mobile.fmcsa.dot.gov/QCDevsite/
  covers: [us-dot:fmcsa-qcmobile-api]
  self_serve: true
  identity: Login.gov
- portal: 'mailto:RsisSupport@dot.gov'
  covers: [us-dot:fra-safety-data-api]
  self_serve: false
- portal: https://data.transportation.gov/profile/edit/developer_settings
  covers: [us-dot:dot-data-hub-soda-api, us-dot:bts-open-data-soda-api]
  self_serve: true
  optional: true
oauth:
  supported: false
  evidence:
  - '/.well-known/oauth-authorization-server -> 404 on every DOT, BTS and FAA host probed 2026-07-28'
  - '/.well-known/openid-configuration -> 404 on every host probed'
  - No OpenAPI declares an oauth2 securityScheme
  consequence: >-
    No scopes/ artifact is emitted for this provider. There is no scope surface to
    describe — key-auth providers have no OAuth scope model, and forcing an empty
    artifact would be misleading.
transport:
  tls_minimum_observed: TLSv1.2
  detail: See security/us-dot-domain-security.yml.