Washington University In St Louis Authentication

---
name: Washington University in St. Louis — Authentication
description: >-
  How Washington University's machine-readable surfaces authenticate. Four distinct regimes are in
  play, and only one of them is an ordinary API credential. CIViC — the institution's genuinely
  public API — reads anonymously and takes an optional bearer API key for writes and for a higher
  rate ceiling. The enterprise integration APIs on MuleSoft Anypoint are not self-service at all:
  access is granted by an internal ServiceNow request and is scoped to WashU integrators. The two
  research repositories harvest anonymously over OAI-PMH. And the institution's Shibboleth IdP is
  federation infrastructure for browser sign-on, not an API credential — it is recorded here because
  it is the gate behind every one of WashU's auth-walled research systems.
generated: '2026-09-01'
x-method: derived
x-authorship: This file is our writing; the mechanisms are quoted from operator docs and live probes.
method: probed
source: >-
  https://docs.civicdb.org/en/latest/api.html (operator documentation), plus live unauthenticated
  probes of civicdb.org/api/graphql, cnda.wustl.edu, balsa.wustl.edu, the two OAI-PMH endpoints and
  mdq.incommon.org on 2026-09-01.
x-operator: institution
url: https://raw.githubusercontent.com/api-evangelist/washington-university-in-st-louis/main/authentication/washington-university-in-st-louis-authentication.yml

mechanisms:
  - id: civic-bearer-api-key
    type: http
    scheme: bearer
    label: CIViC API key as an HTTP bearer token
    in: header
    parameter_names:
      - Authorization
    applies_to:
      - CIViC GraphQL API (https://civicdb.org/api/graphql)
    anonymous_access: >-
      Yes for reads. An unauthenticated POST of a standard introspection query returned HTTP 200 and
      the full 502-type schema on 2026-09-01; no credential was presented or required.
    required_for:
      - All 47 GraphQL mutations (curation, moderation, revision, key management)
      - Any client that needs to exceed the anonymous rate ceiling
    onboarding: >-
      Sign in to civicdb.org, open the user profile, choose "Manage API Keys" and click "Generate
      New API Key". The full token is displayed once at creation; afterwards the list shows only a
      masked reminder. Keys are revocable, and a key can also be minted or revoked through the API
      itself via the generateApiKey and revokeApiKey mutations.
    header_form: 'Authorization: Bearer <CIVIC_API_KEY>'
    operator_guidance: >-
      The operator documents explicitly that keys must not be placed in URLs, query strings,
      checked-in scripts or shared notebooks, and directs callers to environment variables or a
      secrets manager for automated clients. It also asks that any key which is no longer needed or
      may have been exposed be revoked.
    cost: Free. The operator describes the key as "(free)".
    method: searched
    source: https://docs.civicdb.org/en/latest/api.html

  - id: anypoint-servicenow-request
    type: gated
    label: WashU enterprise APIs — access by internal request, no public sign-up
    applies_to:
      - WashU enterprise integration APIs published in MuleSoft Anypoint Exchange
    anonymous_access: >-
      No. The portal pages describing the program are public (HTTP 200), but no endpoint, no
      specification and no credential-issuing flow is reachable without an internal request.
    onboarding: >-
      A WashU integrator requests Anypoint Exchange access through ServiceNow; the process is
      documented at https://data.wustl.edu/api-portal/api-portal-anypoint-access/. There is no
      public developer sign-up, no self-service key, and no published client-registration endpoint.
    audience: WashU faculty, staff and institutional integrators — not the general public.
    method: searched
    source: https://data.wustl.edu/api-portal/api-portal-anypoint-access/

  - id: oai-pmh-anonymous
    type: none
    label: OAI-PMH metadata harvesting — no credential
    applies_to:
      - https://openscholarship.wustl.edu/do/oai/
      - https://digitalcommonsdata.wustl.edu/oai
    anonymous_access: >-
      Yes, fully. Identify, ListMetadataFormats and ListSets all returned HTTP 200 to an
      unauthenticated request on 2026-09-01.
    constraints: >-
      The WashU Scholarly Repository publishes a data policy in its Identify response stating that
      full content may not be harvested by robots without prior written approval; metadata itself is
      explicitly open to commercial and non-commercial service providers.
    method: probed
    source: https://openscholarship.wustl.edu/do/oai/?verb=Identify

  - id: xnat-and-balsa-session-login
    type: gated
    label: Research data platforms — interactive login, no anonymous API
    applies_to:
      - CNDA, the Central Neuroimaging Data Archive (https://cnda.wustl.edu)
      - BALSA neuroimaging database (https://balsa.wustl.edu)
    anonymous_access: >-
      No. Every CNDA path probed — including /data/version and /xapi/swagger.json, which are the
      XNAT REST and OpenAPI endpoints — returns the same 23,725-byte login page at
      /app/template/Login.vm with HTTP 200. That is a soft-200 gate, not an available contract:
      the status code says success and the body is a sign-in form. balsa.wustl.edu is more honest
      about it and returns a 302 to /login/auth.
    note: >-
      XNAT ships a real REST API and an OpenAPI document at /xapi/swagger.json, and the software
      itself originated at WashU's Neuroinformatics Research Group. None of that contract is
      publicly readable here, so none of it is saved under this profile.
    method: probed
    source: https://cnda.wustl.edu/xapi/swagger.json

  - id: shibboleth-saml-idp
    type: federation
    label: WashU Shibboleth identity provider (InCommon)
    entity_id: https://login.wustl.edu/idp/shibboleth
    applies_to:
      - Browser-based single sign-on to WashU services and to federated research services
    protocols:
      - SAML 2.0 (HTTP-POST and HTTP-Redirect SSO bindings)
      - urn:mace:shibboleth:1.0 AuthnRequest profile
    assurance:
      - http://refeds.org/category/research-and-scholarship
      - https://refeds.org/sirtfi
    scope: wustl.edu
    note: >-
      This is not an API credential and no API in this profile accepts it directly. It is recorded
      because it is the institution's own identity infrastructure — operated by WashU, published as
      signed metadata in InCommon, and the gate standing in front of CNDA, BALSA and every Anypoint
      consumer.
    method: probed
    source: https://mdq.incommon.org/entities/https%3A%2F%2Flogin.wustl.edu%2Fidp%2Fshibboleth