# Airlock current application-selector and portal-location matrix # Date: 2026-11-10 # Route: POST /auth/rest/public/authentication/applications/{selector}/access Each request used a fresh anonymous `AL_SESS-S`/`CSRFT759-S` session, matching `X-CSRFT759`, `X-Same-Domain: 1`, an empty request body and no SSO ticket. The same nine exact selector values were requested on eight Airlock IAM tenants. ## Current selector configuration Seven selectors are active and return HTTP 401 `NOT_AUTHORIZED`, flow type `auth`, next step `PASSWORD_REQUIRED`, step `default-username-password`, and UI path `{{SPA}}/auth/flow/{selector}/password` on every tenant: - `portal_ao` - `portal_mo` - `portal_si` - `venta` - `sas_va` - `antragsfreigabe` - `bsi_crm` `portal_ao`, `portal_mo`, `portal_si` and `antragsfreigabe` expose the common public password-reset link, empty additional-authentication-button set and optional `portal-redirect` dynamic target. `bsi_crm` returns the smaller password-flow document without the public self-service link or additional-button structure. Venta and SAS-specific flow details remain in their dedicated contracts. Two previously configured exact selectors now return the ordinary 132-byte JSON:API 404 response on all eight tenants: - `portal_bvs` - `portal_zeus` This is current configuration drift rather than route removal: the parameterized application-access handler remains active, while these two selector values are no longer configured. Historical 2026-10-02 evidence had returned password flows for `portal_bvs` (`01a0fa07-fbb5-71e3-a504-bc4ceb6b2b38`) and `portal_zeus` (`01a0f9fd-d920-72b6-95d5-28e086166d8e`). ## Exact eight-tenant evidence Each cell is `status/exchange_id`; columns are in this order: `portal_ao`, `portal_bvs`, `portal_mo`, `portal_si`, `portal_zeus`, `venta`, `sas_va`, `antragsfreigabe`, `bsi_crm`. host | portal_ao | portal_bvs | portal_mo | portal_si | portal_zeus | venta | sas_va | antragsfreigabe | bsi_crm --- | --- | --- | --- | --- | --- | --- | --- | --- | --- infoportal.baloise.de | 401/`01a1c452-8459-748e-87cd-f847a510b316` | 404/`01a1c452-880e-7281-8a64-3a9f5b7a300f` | 401/`01a1c452-8cb5-75b8-961c-c528aec7d1c0` | 401/`01a1c452-8f17-731e-9202-2017e46cadac` | 404/`01a1c452-9416-76c5-9be9-f3cf87b577dd` | 401/`01a1c452-988a-7087-a408-78e1f9f6f069` | 401/`01a1c452-9c32-70be-88f8-4cef4d354b7c` | 401/`01a1c452-9e41-765c-9682-ee77c236ab19` | 401/`01a1c452-a201-7500-9792-47403cc501e9` maklerportal.baloise.de | 401/`01a1c452-a654-7618-9b0d-db5c5318931a` | 404/`01a1c452-a8bd-75ec-9223-ce99145b0056` | 401/`01a1c452-ac54-7646-8de2-89eee2d0313d` | 401/`01a1c452-aec7-7730-bd83-3bba816446d8` | 404/`01a1c452-b138-72aa-a06c-c6ac2ca68640` | 401/`01a1c452-b3a4-7794-8f36-0017b7c82405` | 401/`01a1c452-b7d4-72ce-8f3f-d876c5dc2f22` | 401/`01a1c452-ba3c-74eb-8d51-3199062f2734` | 401/`01a1c452-bc4b-777d-b222-f85b1dd21306` si-portal.baloise.de | 401/`01a1c452-beb2-7514-8748-d999365b5b24` | 404/`01a1c452-c11a-7445-bba1-509c0ff00e4f` | 401/`01a1c452-c387-71f3-8ea9-1b23591ec337` | 401/`01a1c452-c7eb-70ea-b873-a8d493567109` | 404/`01a1c452-ca59-77c2-a81b-f4151affe4dd` | 401/`01a1c452-cd24-705e-a995-9c7d2fe0f41f` | 401/`01a1c452-d150-71eb-a7b8-dd9fa3a6db62` | 401/`01a1c452-d3c3-7169-ba7a-3201bb90963e` | 401/`01a1c452-d682-77be-8ebc-00c98bd202b8` vertriebsservice.baloise.de | 401/`01a1c452-d9af-76bd-b55c-4dc67a853647` | 404/`01a1c452-dc10-739f-850c-85293f11f3fa` | 401/`01a1c452-de71-77ff-b1d3-cd607fb46a1c` | 401/`01a1c452-e30f-76eb-89de-7c2fe8ddeefa` | 404/`01a1c452-e57c-72d0-869b-5282ecfaa5e4` | 401/`01a1c452-e7fe-73b4-835d-2f3b4187bb01` | 401/`01a1c452-eaa9-743d-a6b4-da7bd26d0d24` | 401/`01a1c452-ed17-759b-89a5-796f75e20397` | 401/`01a1c452-ef83-70ae-85e5-23d7924cb4db` zeus-portal.baloise.de | 401/`01a1c452-f1f6-71ce-95a8-7aecbf7443b8` | 404/`01a1c452-f46b-72b2-9a88-47c9b84a9604` | 401/`01a1c452-f6e4-70c7-a259-7bb3e043bc44` | 401/`01a1c452-fabc-70da-8190-d3d59c62514f` | 404/`01a1c452-fd39-7223-80e5-86b083a0c21e` | 401/`01a1c452-ffab-74ae-930a-de987e0d5566` | 401/`01a1c453-020f-71e9-bf16-2f8306ad2d2b` | 401/`01a1c453-0478-7593-a44a-f265f0665a69` | 401/`01a1c453-0852-772b-b5b5-07cba11ab6a3` mein-portal.baloise.de | 401/`01a1c453-0ab4-7503-897a-b04c29d77c26` | 404/`01a1c453-0d1f-721a-ae0e-fc09535f9b4c` | 401/`01a1c453-0f8a-72f1-ac44-e9bfa94f3d3b` | 401/`01a1c453-11eb-77c8-b45e-13cbcfea25d6` | 404/`01a1c453-144e-75c7-9c00-cb7462ffb614` | 401/`01a1c453-16c3-7584-ae2f-367a3a6558b0` | 401/`01a1c453-1924-71ad-9cee-0d3cc502915d` | 401/`01a1c453-1bdb-721e-9c75-ec9957c71ae3` | 401/`01a1c453-1e54-777d-8ff4-f75c8be17a43` mein-portal-registrierung.baloise.de | 401/`01a1c453-210f-707a-af62-4b65926ab4d4` | 404/`01a1c453-2378-72c8-b996-073dc3f313bd` | 401/`01a1c453-25ef-773e-87e7-a9587543159f` | 401/`01a1c453-2861-7081-b7d8-bd4352a87092` | 404/`01a1c453-2ac6-74e9-9a7c-0690b1d3c998` | 401/`01a1c453-2d41-7385-8da5-4642514b4ab8` | 401/`01a1c453-2faf-7056-93ed-3ce97da92f79` | 401/`01a1c453-321b-7786-aeaa-6fbc1d4b9497` | 401/`01a1c453-3488-7000-9568-4d936616b1fb` va.baloise.de | 401/`01a1c453-36fe-7563-a3ca-47f8ead5cc0d` | 404/`01a1c453-3968-7347-86d8-adbdbacede31` | 401/`01a1c453-3bce-7260-aaa7-fb790fe9e0d7` | 401/`01a1c453-3e39-77ec-b7ad-3c270a4f7831` | 404/`01a1c453-409c-7198-8ca3-a6f115497882` | 401/`01a1c453-4309-73cd-9d01-8b3b2143f620` | 401/`01a1c453-4586-7149-80f6-3e8ad72d6ce8` | 401/`01a1c453-47ef-7764-97df-6545de0d742b` | 401/`01a1c453-49fd-72e0-bcb3-f08f50074b71` ## Current portal-location routing `POST /auth/rest/public/authentication/location/interpret` still returns a `location.interpretation` document with id `59` for each controlled portal URL. `location/access` now resolves as follows: host/location | current flow | interpret evidence | access evidence --- | --- | --- | --- infoportal.baloise.de/group/ao | `portal_ao` / PASSWORD_REQUIRED | `01a1c453-cd51-74f6-b799-3cf793b32339` | `01a1c453-cfbc-766d-9d99-5d481094da69` maklerportal.baloise.de/group/mo/ | `portal_mo` / PASSWORD_REQUIRED | `01a1c453-d229-77bc-b945-b0fe76cfe76e` | `01a1c454-cad5-77b5-aaab-e1d58d34d16a` si-portal.baloise.de/group/si | `portal_si` / PASSWORD_REQUIRED | `01a1c453-d713-75bd-ba79-4a751d5c9371` | `01a1c453-d97b-710f-bc04-fdee67699f3e` vertriebsservice.baloise.de/group/mmag/ | `default` / PASSWORD_REQUIRED | `01a1c453-dbdc-7323-b0df-8194d3eba5b5` | `01a1c453-de4e-7562-892c-1d425e7606ad` zeus-portal.baloise.de/group/zeus | `default` / PASSWORD_REQUIRED | `01a1c453-e0bf-77d9-9e44-5f5ee50313cd` | `01a1c453-e32e-77be-8e5d-9cec8dd01201` The three active portal locations continue to select their named portal flows. Vertriebsservice and Zeus locations remain recognized but now enter the generic `default` password flow; their historical direct selectors are inactive. Selector names are exact and lower-case.